WinupGro et Virus

Résolu
X_Cyr -  
Bonjour,
J'ai chopé plusieurs virus :
- Backdoor.Graybird
- Dialer.stardial
- Adware.Begin2search
- Adware.ZenoSearch

Et un Bagle :
WinUpGro

Je sais que j'ai d'autres trojan mais je ne me souviens plus.

Le problème est que Norton a été bloqué et ne veut plus démarrer. J'ai lancé un "FindyKill" et un "CCleaner". Maintenant je me demande s'il reste des virus et comment je peux redémarrer Norton ? Si je dois le réinstaller il faut que mon Pc soit clean.
Merci par avance.
Configuration: Windows XP
Firefox 2.0.0.18

16 réponses

Résumé de la discussion

Plusieurs malwares ont été détectés, notamment Backdoor.Graybird, Dialer.stardial et Adware.Begin2search, entre autres, ce qui indique une infection virale et une compromission potentielle du navigateur et des composants système. Le système tourne sous Windows XP et Norton est bloqué; après FindyKill et CCleaner, l'utilisateur se demande s'il reste des virus et s'il faut réinstaller Norton sur un PC sain. Les réponses présentent des rapports d'analyse montrant des éléments suspects comme g37.exe et des composants relevés par HijackThis et RSIT, indiquant une infection complexe et des entrées actives. Des indices supplémentaires révèlent des démarrages et services modifiés, des outils tiers et des BHO associés, suggérant une contamination étendue nécessitant un nettoyage approfondi ou une réinstallation complète.

Bobot (l’IA à votre service)
  1. jlpjlp Contributeur sécurité
    slt,

    vire tes cracks

    puis

    Télécharge Combofix de sUBs : aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315

    http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    Sauvegarde le sur ton bureau et pas ailleurs !

    Aide à l’utilisation de combofix ici: http://bibou0007.forumpro.fr/tutos-f45/tutorial-combofix-t12­1.htm

    Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
    Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.
    _________________

    colle un rapport hijackthis
    https://www.01net.com/404/

    manuel :

    http://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.ht(...)

    Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.

    ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

    Ensuite avec Explorer créer un dossier c:\hijackthis
    Décompresser Hijackthis dans ce dossier.
    C'est important pour les sauvegardes."
    0
    1. X_Cyr
      Hum... En attendant j'ai fais un Malwarebytes' Anti-Malware
      J'ai eu ce rapport :
      Processus mémoire infecté(s): 0
      Module(s) mémoire infecté(s): 0
      Clé(s) du Registre infectée(s): 4
      Valeur(s) du Registre infectée(s): 1
      Elément(s) de données du Registre infecté(s): 1
      Dossier(s) infecté(s): 0
      Fichier(s) infecté(s): 2

      Processus mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Module(s) mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Clé(s) du Registre infectée(s):
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2db32fc3-67e2-5e28-6d4d-43001fcb7d5c} (Adware.BHO) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\CLSID\{2db32fc3-67e2-5e28-6d4d-43001fcb7d5c} (Adware.BHO) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c5d9ee94-e42b-f5d1-66fe-9b1b2f0d9e6b} (Adware.BHO) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\CLSID\{c5d9ee94-e42b-f5d1-66fe-9b1b2f0d9e6b} (Adware.BHO) -> Quarantined and deleted successfully.

      Valeur(s) du Registre infectée(s):
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pwvrbksfnwmuew (Trojan.Agent) -> Quarantined and deleted successfully.

      Elément(s) de données du Registre infecté(s):
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\Local Page (Hijack.Search) -> Bad: (http://www2.iesearch.com/) Good: (https://www.google.com/?gws_rd=ssl -> Not selected for removal.

      Dossier(s) infecté(s):
      (Aucun élément nuisible détecté)

      Fichier(s) infecté(s):
      C:\WINDOWS\system32\wzhlskmfnllzmv.dll (Trojan.Agent) -> Delete on reboot.
      C:\WINDOWS\system32\szfjmbqaughth.dll (Adware.BHO) -> Delete on reboot.
      Mais que puis-je faire encore ?
      0
      1. jlpjlp Contributeur sécurité
        tu redémarre l'ordi pour finir la désinfection de malwarebyte et tu vire ce qui a été mis en quarantaine

        puis tu fais le message précédent
        0
        1. X_Cyr
          Bjr jlpjlp,

          Voici le rapport de comboFix. Je lance HijackThis apres.

          Lancé depuis: c:\documents and settings\Cyrille\Bureau\ComboFix.exe
          .

          ((((((((((((((((((((((((((((( Fichiers créés du 2008-11-12 au 2008-12-12 ))))))))))))))))))))))))))))))))))))
          .

          2008-12-12 13:00 . 2008-12-12 13:11 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
          2008-12-12 13:00 . 2008-12-12 13:00 <REP> d-------- c:\documents and settings\Cyrille\Application Data\Malwarebytes
          2008-12-12 13:00 . 2008-12-12 13:00 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
          2008-12-12 13:00 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
          2008-12-12 13:00 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
          2008-12-12 12:28 . 2008-12-12 12:28 <REP> d-------- c:\program files\Trend Micro
          2008-12-12 12:01 . 2008-12-12 12:01 <REP> d--h----- c:\documents and settings\Cyrille\Application Data\drivers
          2008-12-12 11:54 . 2008-12-12 11:54 <REP> d-------- c:\program files\CCleaner
          2008-12-12 10:51 . 2008-12-12 10:55 <REP> d-------- c:\program files\Windows Live Safety Center
          2008-12-12 10:33 . 2008-12-12 11:34 <REP> d-------- c:\program files\FindyKill
          2008-12-12 09:28 . 2008-12-12 09:28 <REP> d-------- c:\documents and settings\NetworkService\Application Data\X10 Commander
          2008-12-12 09:27 . 2008-12-12 11:35 468,490 --a------ c:\windows\system32\perfh040.dat
          2008-12-12 09:27 . 2008-12-12 11:35 75,506 --a------ c:\windows\system32\perfc040.dat
          2008-12-11 18:17 . 2008-12-11 18:17 <REP> d--h----- c:\documents and settings\All Users\Application Data\{7DE2D9B5-C959-4D68-9E63-E73738EF6F02}
          2008-12-05 23:02 . 2008-12-05 23:40 <REP> d-------- c:\documents and settings\Cyrille\Application Data\Skype
          2008-12-05 23:01 . 2008-12-05 23:01 <REP> d-------- c:\program files\Skype
          2008-12-05 23:01 . 2008-12-05 23:01 <REP> d-------- c:\program files\Fichiers communs\Skype
          2008-12-04 11:08 . 2008-12-04 11:08 30 --a------ c:\windows\Iedit.INI
          2008-11-29 22:01 . 2008-11-29 22:30 <REP> d-------- c:\program files\uTorrent
          2008-11-29 22:01 . 2008-12-05 23:48 <REP> d-------- c:\documents and settings\Cyrille\Application Data\uTorrent
          2008-11-29 19:18 . 2008-11-29 19:18 268 --ah----- C:\sqmdata12.sqm
          2008-11-29 19:18 . 2008-11-29 19:18 244 --ah----- C:\sqmnoopt12.sqm
          2008-11-23 17:02 . 2008-11-23 17:06 <REP> d-------- c:\program files\ConTEXT
          2008-11-23 16:35 . 2008-11-23 16:35 <REP> d-------- C:\xampp
          2008-11-20 21:44 . 2008-11-20 21:44 42,320 --a------ c:\windows\system32\xfcodec.dll
          2008-11-19 19:23 . 2006-09-20 16:58 40,960 --a------ c:\windows\system32\psfind.dll
          2008-11-18 22:43 . 2008-12-02 14:22 <REP> d-------- c:\documents and settings\Cyrille\Application Data\dvdcss
          2008-11-17 16:59 . 2008-11-17 17:07 <REP> d-------- c:\program files\Celtx
          2008-11-15 15:45 . 2008-11-15 15:45 268 --ah----- C:\sqmdata11.sqm
          2008-11-15 15:45 . 2008-11-15 15:45 244 --ah----- C:\sqmnoopt11.sqm
          2008-11-13 10:42 . 2008-11-13 10:43 <REP> d-------- c:\documents and settings\Cyrille\Application Data\vlc
          2008-11-13 10:40 . 2008-11-13 10:40 <REP> d-------- c:\program files\VideoLAN
          2008-11-13 10:15 . 2008-09-04 18:16 1,106,944 --------- c:\windows\system32\dllcache\msxml3.dll
          2008-11-13 10:15 . 2008-10-24 12:21 455,296 --------- c:\windows\system32\dllcache\mrxsmb.sys

          .
          (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
          .
          2008-12-11 20:14 --------- d-----w c:\program files\eMule
          2008-12-11 17:18 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
          2008-12-11 17:17 --------- d-----w c:\program files\Iminent
          2008-12-10 14:13 --------- d-----w c:\documents and settings\Cyrille\Application Data\HPAppData
          2008-12-10 10:22 --------- d-----w c:\program files\CVitae
          2008-12-09 13:39 47,586 ----a-w c:\windows\system32\vyerrgqjrbgvvcn.exe
          2008-12-09 09:58 --------- d-----w c:\documents and settings\Cyrille\Application Data\Aim Style Heart
          2008-12-09 04:21 68,513 ----a-w c:\windows\system32\szfjmbqaughth.dll-uninst.exe
          2008-12-05 22:03 --------- d-----w c:\documents and settings\Cyrille\Application Data\skypePM
          2008-12-05 22:01 --------- d-----w c:\documents and settings\All Users\Application Data\Skype
          2008-12-01 08:38 --------- d-----w c:\program files\Norton Internet Security
          2008-12-01 08:32 --------- d-s---w c:\program files\Xfire
          2008-11-30 15:54 --------- d-----w c:\documents and settings\Cyrille\Application Data\Xfire
          2008-11-27 08:07 --------- d-----w c:\program files\Google
          2008-11-19 18:19 --------- d--h--w c:\program files\InstallShield Installation Information
          2008-11-19 18:19 --------- d-----w c:\program files\THQ
          2008-10-26 09:57 --------- d-----w c:\documents and settings\Cyrille\Application Data\Wallpaper
          2008-10-26 09:30 --------- d-----w c:\program files\Wallpaper
          2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
          2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
          2008-10-23 12:36 286,720 ------w c:\windows\system32\dllcache\gdi32.dll
          2008-10-17 00:48 3,593,216 ----a-w c:\windows\system32\dllcache\mshtml.dll
          2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
          2008-10-16 13:13 202,776 ----a-w c:\windows\system32\dllcache\wuweb.dll
          0
      2. X_Cyr
        Et... Voici la suite : pour Hijackthis

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 14:05:14, on 12/12/2008
        Platform: Windows XP SP3 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16762)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\xampp\xampp\apache\bin\apache.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\eHome\ehRecvr.exe
        C:\WINDOWS\eHome\ehSched.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
        C:\xampp\xampp\mysql\bin\mysqld-nt.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\nvsvc32.exe
        C:\WINDOWS\system32\rundll32.exe
        C:\Program Files\QuickTime\qttask.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
        C:\Program Files\Picasa2\PicasaMediaDetector.exe
        C:\Program Files\Wallpaper\Wallpaper.exe
        C:\Program Files\Iminent\imbooster.exe
        C:\Program Files\FinePixViewerS\QuickDCF2.exe
        C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
        C:\Program Files\Hercules\WiFi Station\WifiStation.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Documents and Settings\Cyrille\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
        C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
        C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
        C:\Program Files\Zapu\Zapu\wDivi.exe
        C:\Documents and Settings\Cyrille\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
        C:\xampp\xampp\apache\bin\apache.exe
        C:\WINDOWS\system32\dllhost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
        C:\WINDOWS\explorer.exe
        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        R3 - URLSearchHook: torrent_search Toolbar - {f14b0ccd-aa41-4406-ab68-c5de9d85b4a3} - C:\Program Files\torrent_search\tbtorr.dll
        R3 - URLSearchHook: Secured_eMule toolbar - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - C:\Program Files\Secured_eMule\tbSecu.dll
        R3 - URLSearchHook: securedie Toolbar - {cd36797a-70f3-4acd-8825-623d3b896881} - C:\Program Files\securedie\tbsecu.dll
        R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
        R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
        O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
        O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
        O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
        O2 - BHO: Iminent.SearchTheWeb.HelperObject - {0E896FCA-D07E-45FE-901F-6A26FCF59C02} - mscoree.dll (file missing)
        O2 - BHO: Secured_eMule toolbar - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - C:\Program Files\Secured_eMule\tbSecu.dll
        O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
        O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
        O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
        O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
        O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
        O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\APPS\BAE\BAE.dll
        O2 - BHO: securedie Toolbar - {cd36797a-70f3-4acd-8825-623d3b896881} - C:\Program Files\securedie\tbsecu.dll
        O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
        O2 - BHO: torrent_search Toolbar - {f14b0ccd-aa41-4406-ab68-c5de9d85b4a3} - C:\Program Files\torrent_search\tbtorr.dll
        O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
        O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
        O3 - Toolbar: torrent_search Toolbar - {f14b0ccd-aa41-4406-ab68-c5de9d85b4a3} - C:\Program Files\torrent_search\tbtorr.dll
        O3 - Toolbar: Secured_eMule toolbar - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - C:\Program Files\Secured_eMule\tbSecu.dll
        O3 - Toolbar: securedie Toolbar - {cd36797a-70f3-4acd-8825-623d3b896881} - C:\Program Files\securedie\tbsecu.dll
        O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
        O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
        O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
        O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
        O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
        O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
        O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
        O4 - HKCU\..\Run: [Wallpaper] "C:\Program Files\Wallpaper\Wallpaper.exe" Starter
        O4 - HKCU\..\Run: [IMBooster] C:\Program Files\Iminent\imbooster.exe /warmup
        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
        O4 - Startup: Outil de notification Live Search.lnk = Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
        O4 - Startup: Zapu Acceleration Engine.lnk = C:\Program Files\Zapu\Zapu\wincm.exe
        O4 - Startup: Zapu.lnk = C:\Program Files\Zapu\Zapu\wDivi.exe
        O4 - Global Startup: Exif Launcher S.lnk = ?
        O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
        O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
        O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
        O4 - Global Startup: WiFi Station.lnk = ?
        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
        O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
        O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
        O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
        O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
        O14 - IERESET.INF: START_PAGE_URL=http://format.packardbell.com/cgi-bin/redirect/?country=FR&range=AD&phase=8&key=IESTART
        O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
        O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game10.zylom.com/activex/zylomgamesplayer.cab
        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
        O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = skyson
        O17 - HKLM\Software\..\Telephony: DomainName = skyson
        O17 - HKLM\System\CCS\Services\Tcpip\..\{16D59095-99F6-4D1A-8B88-880639D6A718}: NameServer = 80.118.192.100,80.118.196.36
        O17 - HKLM\System\CCS\Services\Tcpip\..\{90D4FA0B-9A0F-4183-BA5B-014247BB8022}: NameServer = 212.30.96.108,212.30.124.146
        O17 - HKLM\System\CCS\Services\Tcpip\..\{AC5A431E-F610-4702-8195-53213055EABB}: NameServer = 212.30.96.108,212.30.124.146
        O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = skyson
        O17 - HKLM\System\CS1\Services\Tcpip\..\{16D59095-99F6-4D1A-8B88-880639D6A718}: NameServer = 80.118.192.100,80.118.196.36
        O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = skyson
        O17 - HKLM\System\CS2\Services\Tcpip\..\{16D59095-99F6-4D1A-8B88-880639D6A718}: NameServer = 80.118.192.100,80.118.196.36
        O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = skyson
        O17 - HKLM\System\CS3\Services\Tcpip\..\{16D59095-99F6-4D1A-8B88-880639D6A718}: NameServer = 80.118.192.100,80.118.196.36
        O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
        O23 - Service: Apache2.2 - Apache Software Foundation - C:\xampp\xampp\apache\bin\apache.exe
        O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
        O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
        O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
        O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
        O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
        O23 - Service: mysql - Unknown owner - C:\xampp\xampp\mysql\bin\mysqld-nt.exe
        O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
        O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
        O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
        O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
        0
        1. X_Cyr
          Et pour Norton, quelqu'un peut-il me dire comment faire svp ?
          En faite, quand je clic dessus j'ai ce message :
          "C:\Program Files\Fichiers communs\Symantec Shared\Nmain.exe n'est pas une application Win32 valide."

          C'est du à un virus ou un truc comme ca ?
          0
      4. jlpjlp Contributeur sécurité
        télécharge OTMoveIt
        http://oldtimer.geekstogo.com/OTMoveIt3.exe (de Old_Timer) sur ton Bureau.

        double-clique sur OTMoveIt.exe pour le lancer.
        copie la liste qui se trouve en citation ci-dessous,
        et colle-la dans le cadre de gauche de OTMoveIt :Paste instruction for items to be moved.
        (attention bien mettre :files)

        :files
        c:\windows\system32\vyerrgqjrbgvvcn.exe
        c:\documents and settings\Cyrille\Application Data\Aim Style Heart
        c:\windows\system32\szfjmbqaughth.dll-uninst.exe

        clique sur MoveIt! pour lancer la suppression.
        le résultat apparaitra dans le cadre "Results".
        clique sur Exit pour fermer.
        poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

        il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

        __________________

        tu télécharge Lop S&D.exe sur ton Bureau.https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2

        * Double-clique dessus pour lancer l'installation
        * Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau
        * Séléctionne la langue souhaitée , puis choisis l'option 1 (Recherche)
        * Patiente jusqu'à la fin du scan
        * Poste le rapport généré (C:\lopR.txt)

        __________________

        Télécharges AD-Remover ( de Cyrildu17 / C_XX ) sur ton bureau :
        http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe

        /!\ Déconnectes toi et fermes toutes applications en cours

        ● Double clique sur le programme d'installation , et installe le dans son emplacement par défaut. ( C:\Program files )
        ● Double clique sur l'icône Ad-removersituée sur ton bureau
        ● Au menu principal choisi l'option "A"
        ● Postes le rapport qui apparait à la fin .

        ( le rapport est sauvegardé aussi sous C:\Ad-report(date).log )

        (CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

        Note :

        "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
        Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
        Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

        _________________

        rq:

        pour norton il va falloir le virer par la suite et le remettre comme ceci:
        http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20050414110429924
        0
        1. X_Cyr
          Otmovedfiles :

          ========== FILES ==========
          c:\windows\system32\vyerrgqjrbgvvcn.exe moved successfully.
          c:\documents and settings\Cyrille\Application Data\Aim Style Heart moved successfully.
          c:\windows\system32\szfjmbqaughth.dll-uninst.exe moved successfully.

          OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12122008_211625
          0
      5. jlpjlp Contributeur sécurité
        ok fais le reste
        0
        1. X_Cyr
          Voici :

          --------- Logfile of AD-Remover 1.0.7.5 by C_XX ---------

          # START at: 21:33:27 | Ven 12/12/2008 | Microsoft® Windows XP™ (v5.1.2600)
          # BOOT MODE: MSE

          # OPTION: Scan | EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat

          # PC: cyrillehome | USER: Cyrille ( Current user is an administrator)

          # DRIVE(S):
          - C:\ (File System: NTFS)

          # Internet Explorer v7.0.5730.13

          --------- [ RUNNING PROCESSES: 10 ] ---------

          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\csrss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\Explorer.EXE
          C:\WINDOWS\system32\ntvdm.exe

          -----------------------------------

          +-----------------------| Boonty/Boonty Games Elements found :

          .

          +-----------------------| Eorezo Elements found :

          .

          +-----------------------| Everest Poker Elements found :

          .

          +-----------------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements found :

          .

          +-----------------------| Messenger Skinner Elements found :

          .

          +-----------------------| Sweetim Elements found :

          "HKEY_CLASSES_ROOT\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}"
          "HKEY_CLASSES_ROOT\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}"
          "HKEY_CLASSES_ROOT\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}"
          "HKEY_CLASSES_ROOT\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}"
          "HKEY_CLASSES_ROOT\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}"
          "HKEY_CLASSES_ROOT\Installer\Features\5D72AF385B5242D47B69FD47F2805AFC"
          "HKEY_CLASSES_ROOT\Installer\Features\428C9AFC877ABE7409DCBBD48BC23F84"
          "HKEY_CLASSES_ROOT\Installer\Features\5D72AF385B5242D47B69FD47F2805AFC"
          "HKEY_CLASSES_ROOT\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0"
          "HKEY_CLASSES_ROOT\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632"
          "HKEY_CLASSES_ROOT\SWEETIE.IEToolbar"
          "HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1"
          "HKEY_CLASSES_ROOT\SWEETIE.SWEETIE"
          "HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3"
          "HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook"
          "HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1"
          "HKEY_CLASSES_ROOT\Toolbar3.SWEETIE"
          "HKEY_CLASSES_ROOT\Toolbar3.SWEETIE.1"
          "HKEY_CLASSES_ROOT\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}"
          "HKEY_CLASSES_ROOT\Typelib\{EEE6C35F-6118-11DC-9C72-001320C79847}"
          "HKEY_CLASSES_ROOT\MgMediaPlayer.GifAnimator"
          "HKEY_CLASSES_ROOT\MgMediaPlayer.GifAnimator.1"
          "HKEY_CURRENT_USER\SOFTWARE\SweetIM"
          "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks" /v "{EEE6C35D-6118-11DC-9C72-001320C79847}"
          "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}"
          "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}"
          "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\428C9AFC877ABE7409DCBBD48BC23F84"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\5D72AF385B5242D47B69FD47F2805AFC"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar" /v "{EEE6C35B-6118-11DC-9C72-001320C79847}"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CFA9C824-A778-47EB-90CD-BB4DB82CF348}"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{83FA27D5-25B5-4D24-B796-DF742F08A5CF}"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02F47BF73B948514FAACADD8CBBDF37D"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\080D9F5E1E95FEE4794CE438E635239E"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1E264E0A5959A1C46BA9175A878B12EA"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2E6768B6932D112438F047C54D180635"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\351716A953E21214898904032EAE2E81"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A189D17A469616C4688D23E192996267"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4318DF19719275242801CBE292063A4C"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F754C503375A13344B22388E18DFE87E"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\5D72AF385B5242D47B69FD47F2805AFC"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\428C9AFC877ABE7409DCBBD48BC23F84"
          "HKEY_LOCAL_MACHINE\SOFTWARE\SweetIM"
          .
          [26/08/2008 19:26|d--------] C:\Program Files\SweetIM
          [26/08/2008 19:26|--a------] C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\searchplugins\sweetim.xml
          [26/08/2008 19:26|d--------] C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
          [27/08/2008 17:32|d--------] C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\SweetIMToolbarData
          [26/08/2008 19:26|d--------] C:\Documents and Settings\All Users\Application Data\SweetIM

          +-----------------------| ADDED SCAN :

          +---------- Scanning prefs.js ... ( # Mozilla User Preferences )

          ...\n9e00o1n.default\prefs.js :

          ~~~~ Mozilla FireFox version 2.0.0.18 ~~~~

          Start Page : "https://www.google.fr/?gws_rd=ssl"

          +----------+

          FOUND - user_pref("browser.search.defaulturl", "https://search.sweetim.com/search.asp?src=2&q=");
          FOUND - user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");
          FOUND - user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");
          FOUND - user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");
          FOUND - user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");
          FOUND - user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");
          FOUND - user_pref("sweetim.toolbar.mode.debug", "false");
          FOUND - user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engine=\"http://*google.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"https://search.yahoo.com/*\" param=\"p=\" /><EXTERNAL_SEARCH engine=\"http://search.sweetim.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"http://*.live.*/*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"http://*youtube.com/\" param=\"search_query=\" /><EXTERNAL_SEARCH engine=\"http://*.ebay.*/search/*\" param=\"satitle=\" /><EXTERNAL_SEARCH engine=\"http://*.amazon.com/s/*\" param=\"field-keywords=\" /></TOOLBAR>");
          FOUND - user_pref("sweetim.toolbar.search.history.capacity", "10");
          FOUND - user_pref("sweetim.toolbar.simapp_id", "{C1A8DAC6-98BE-4301-BCD5-29354E23E244}");
          FOUND - user_pref("sweetim.toolbar.version", "1.0.0.3");

          +---------------------------------------------------------------------------+

          +--[HKEY_CURRENT_USER\..\Run]

          ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe
          LDM REG_SZ C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
          LogitechSoftwareUpdate REG_SZ "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
          updateMgr REG_SZ C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
          Picasa Media Detector REG_SZ C:\Program Files\Picasa2\PicasaMediaDetector.exe
          Wallpaper REG_SZ "C:\Program Files\Wallpaper\Wallpaper.exe" Starter
          IMBooster REG_SZ C:\Program Files\Iminent\imbooster.exe /warmup

          +--[HKEY_LOCAL_MACHINE\..\Run]

          NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
          ccApp REG_SZ "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
          nwiz REG_SZ nwiz.exe /install
          hpqSRMon REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
          QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
          Symantec PIF AlertEng REG_SZ "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

          +--[HKEY_USERS\.DEFAULT\..\Run]

          CTFMON.EXE REG_SZ C:\WINDOWS\system32\CTFMON.EXE

          +--[HKEY_CURRENT_USER\..\Internet Explorer\MAIN]

          Start Page : hxxp://google.fr/

          +--[HKEY_LOCAL_MACHINE\..\Internet Explorer\MAIN]

          Start Page : hxxp://home.sweetim.com

          +---------------------------------------------------------------------------+

          - "C:\AD-report-12.12.2008.log" (14531 octets)

          [ END at: 21:33:39 | 12/12/2008 ] - [ Time elapsed: 11.5 seconds ]

          +---------------------------------------------------------------------------+
          +------------------------------- [ E.O.F - 163 lines ]
          +---------------------------------------------------------------------------+
          0
      6. X_Cyr
        La suite

        --------------------\\ Lop S&D 4.2.4-9c XP/Vista

        Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
        X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz )
        BIOS : Phoenix - AwardBIOS v6.00PG
        USER : Cyrille ( Administrator )
        BOOT : Normal boot
        Antivirus : Norton Internet Security 2006 2006 (Activated)
        Firewall : Norton Internet Security 2006 2006 (Activated)
        C:\ (Local Disk) - NTFS - Total:290 Go (Free:90 Go)
        D:\ (CD or DVD)
        F:\ (USB)
        G:\ (USB)
        H:\ (USB)
        I:\ (USB)

        "C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
        Option : [1] ( 12/12/2008|21:20 )

        --------------------\\ Listing des dossiers dans APPLIC~1

        [10/12/2006|14:13] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
        [10/12/2006|14:13] C:\DOCUME~1\ADMINI~1\APPLIC~1\Macromedia
        [10/12/2006|14:13] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
        [10/12/2006|14:13] C:\DOCUME~1\ADMINI~1\APPLIC~1\Mozilla
        [10/12/2006|14:14] C:\DOCUME~1\ADMINI~1\APPLIC~1\Symantec
        [10/12/2006|14:13] C:\DOCUME~1\ADMINI~1\APPLIC~1\You've Got Pictures Screensaver

        [11/12/2008|18:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{7DE2D9B5-C959-4D68-9E63-E73738EF6F02}
        [29/06/2008|14:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
        [04/08/2008|19:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\albumphoto
        [29/01/2008|16:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
        [11/08/2008|13:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BufferZone
        [25/05/2007|21:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
        [31/08/2008|00:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations
        [16/01/2008|16:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
        [13/08/2008|12:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Hewlett-Packard
        [13/08/2008|12:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
        [13/08/2008|12:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP Product Assistant
        [13/08/2008|12:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HPSSUPPLY
        [28/08/2008|06:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Htm Support Bait Deaf
        [06/08/2008|17:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\IM
        [06/08/2008|17:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\IncrediMail
        [10/12/2006|14:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
        [12/12/2008|13:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
        [20/08/2008|19:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
        [10/08/2008|13:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NOS
        [04/09/2008|07:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
        [10/12/2006|14:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\OD2
        [29/06/2008|13:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
        [05/12/2008|23:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
        [10/12/2006|14:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SmartSound Software Inc
        [26/08/2008|19:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM
        [06/10/2008|07:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
        [10/12/2006|14:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ulead Systems
        [10/12/2006|14:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
        [13/08/2008|13:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WEBREG
        [24/07/2008|11:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
        [29/06/2008|12:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
        [18/02/2007|15:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\X10 Settings
        [25/07/2008|11:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

        [08/08/2008|13:15] C:\DOCUME~1\Cyrille\APPLIC~1\Adobe
        [29/06/2008|14:50] C:\DOCUME~1\Cyrille\APPLIC~1\AdobeUM
        [30/03/2007|17:05] C:\DOCUME~1\Cyrille\APPLIC~1\Ahead
        [25/05/2007|21:38] C:\DOCUME~1\Cyrille\APPLIC~1\CyberLink
        [13/05/2008|18:25] C:\DOCUME~1\Cyrille\APPLIC~1\DivX
        [02/12/2008|14:22] C:\DOCUME~1\Cyrille\APPLIC~1\dvdcss
        [29/06/2008|13:29] C:\DOCUME~1\Cyrille\APPLIC~1\FotoWire
        [04/06/2008|15:53] C:\DOCUME~1\Cyrille\APPLIC~1\FUJIFILM
        [24/04/2008|13:33] C:\DOCUME~1\Cyrille\APPLIC~1\Greyfirst
        [04/09/2007|21:14] C:\DOCUME~1\Cyrille\APPLIC~1\Help
        [13/08/2008|19:30] C:\DOCUME~1\Cyrille\APPLIC~1\HP
        [10/12/2008|15:13] C:\DOCUME~1\Cyrille\APPLIC~1\HPAppData
        [10/12/2006|14:13] C:\DOCUME~1\Cyrille\APPLIC~1\Identities
        [26/08/2008|20:32] C:\DOCUME~1\Cyrille\APPLIC~1\Iminent
        [04/06/2008|15:49] C:\DOCUME~1\Cyrille\APPLIC~1\InstallShield
        [26/03/2007|21:46] C:\DOCUME~1\Cyrille\APPLIC~1\Leadertech
        [10/12/2006|14:13] C:\DOCUME~1\Cyrille\APPLIC~1\Macromedia
        [12/12/2008|13:00] C:\DOCUME~1\Cyrille\APPLIC~1\Malwarebytes
        [24/08/2008|16:07] C:\DOCUME~1\Cyrille\APPLIC~1\Microsoft
        [10/12/2006|14:13] C:\DOCUME~1\Cyrille\APPLIC~1\Mozilla
        [29/06/2008|19:50] C:\DOCUME~1\Cyrille\APPLIC~1\MSNInstaller
        [25/03/2007|11:16] C:\DOCUME~1\Cyrille\APPLIC~1\My Games
        [26/01/2007|17:27] C:\DOCUME~1\Cyrille\APPLIC~1\OD2
        [25/07/2008|09:40] C:\DOCUME~1\Cyrille\APPLIC~1\Real
        [05/12/2008|23:40] C:\DOCUME~1\Cyrille\APPLIC~1\Skype
        [05/12/2008|23:03] C:\DOCUME~1\Cyrille\APPLIC~1\skypePM
        [26/03/2007|21:46] C:\DOCUME~1\Cyrille\APPLIC~1\Sonic
        [26/03/2007|21:23] C:\DOCUME~1\Cyrille\APPLIC~1\Sun
        [31/08/2008|08:18] C:\DOCUME~1\Cyrille\APPLIC~1\Symantec
        [27/07/2007|19:56] C:\DOCUME~1\Cyrille\APPLIC~1\Ulead Systems
        [05/12/2008|23:48] C:\DOCUME~1\Cyrille\APPLIC~1\uTorrent
        [13/11/2008|10:43] C:\DOCUME~1\Cyrille\APPLIC~1\vlc
        [26/10/2008|10:57] C:\DOCUME~1\Cyrille\APPLIC~1\Wallpaper
        [30/11/2008|16:54] C:\DOCUME~1\Cyrille\APPLIC~1\Xfire
        [10/12/2006|14:13] C:\DOCUME~1\Cyrille\APPLIC~1\You've Got Pictures Screensaver

        [10/12/2006|14:13] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
        [10/12/2006|14:13] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Macromedia
        [10/12/2006|14:13] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
        [10/12/2006|14:13] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Mozilla
        [10/12/2006|14:14] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec
        [10/12/2006|14:13] C:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver

        [14/05/2008|01:15] C:\DOCUME~1\LOCALS~1\APPLIC~1\DivX
        [10/12/2006|14:13] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
        [10/12/2006|14:14] C:\DOCUME~1\LOCALS~1\APPLIC~1\X10 Commander

        [10/12/2006|14:13] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
        [12/12/2008|09:28] C:\DOCUME~1\NETWOR~1\APPLIC~1\X10 Commander

        --------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

        [12/12/2008 18:00][--a------] C:\WINDOWS\tasks\Configurer mon PC.job
        [12/12/2008 20:00][--a------] C:\WINDOWS\tasks\Norton AntiVirus - Effectuer une analyse complŠte du systŠme - Cyrille.job
        [12/12/2008 18:00][--a------] C:\WINDOWS\tasks\Extension de garantie.job
        [12/12/2008 18:00][--a------] C:\WINDOWS\tasks\Master CD_DVD Creator.job
        [26/01/2007 17:17][--a------] C:\WINDOWS\tasks\Rappel d'enregistrement 2.job
        [12/12/2008 20:23][--ah-----] C:\WINDOWS\tasks\SA.DAT
        [10/08/2004 14:00][-rah-c---] C:\WINDOWS\tasks\desktop.ini

        --------------------\\ Listing des dossiers dans C:\Program Files

        [06/07/2008|21:51] C:\Program Files\2K Games
        [27/06/2007|15:02] C:\Program Files\3DO
        [10/12/2006|14:13] C:\Program Files\Adobe
        [30/03/2007|18:31] C:\Program Files\Ahead
        [28/08/2008|06:12] C:\Program Files\Aim Style Heart
        [02/12/2007|14:43] C:\Program Files\ANNO 1503 GOLD
        [03/02/2008|17:40] C:\Program Files\Anuman Interactive
        [29/01/2008|16:51] C:\Program Files\AOL 9.0
        [10/12/2006|14:14] C:\Program Files\AOL Compagnon
        [09/09/2007|14:07] C:\Program Files\Aquatic Tycoon
        [30/01/2007|10:50] C:\Program Files\Atari
        [09/03/2007|11:49] C:\Program Files\Bethesda Softworks
        [11/08/2008|12:23] C:\Program Files\BitTorrent Fastest Tool
        [19/09/2008|20:22] C:\Program Files\Black Isle
        [16/10/2007|18:49] C:\Program Files\Browser Mouse
        [24/08/2008|16:27] C:\Program Files\BufferZone
        [12/12/2008|11:54] C:\Program Files\CCleaner
        [17/11/2008|17:07] C:\Program Files\Celtx
        [10/12/2006|14:13] C:\Program Files\Common Files
        [10/12/2006|14:13] C:\Program Files\ComPlus Applications
        [11/08/2008|12:22] C:\Program Files\Conduit
        [23/11/2008|17:06] C:\Program Files\ConTEXT
        [10/12/2008|11:22] C:\Program Files\CVitae
        [10/12/2006|14:13] C:\Program Files\CyberLink
        [16/02/2007|12:43] C:\Program Files\directx
        [18/08/2008|19:39] C:\Program Files\DivX
        [27/01/2008|15:11] C:\Program Files\Doom 3
        [29/10/2007|23:47] C:\Program Files\EasyPHP 2.0b1
        [11/12/2008|21:14] C:\Program Files\eMule
        [03/09/2007|13:09] C:\Program Files\EPSON
        [12/12/2008|13:56] C:\Program Files\Fichiers communs
        [12/12/2008|20:26] C:\Program Files\FindyKill
        [30/08/2008|23:51] C:\Program Files\FinePixViewerS
        [26/01/2007|17:45] C:\Program Files\Firaxis Games
        [03/01/2008|19:10] C:\Program Files\FireFly Studios
        [12/04/2007|21:14] C:\Program Files\Gabest
        [28/02/2008|13:28] C:\Program Files\glGo
        [27/11/2008|09:07] C:\Program Files\Google
        [12/08/2008|18:28] C:\Program Files\Hercules
        [13/08/2008|12:56] C:\Program Files\Hewlett-Packard
        [13/08/2008|12:58] C:\Program Files\HP
        [17/11/2007|12:00] C:\Program Files\IconColl
        [11/12/2008|18:17] C:\Program Files\Iminent
        [20/07/2007|13:43] C:\Program Files\Infogrames
        [04/11/2007|23:59] C:\Program Files\InstallShield
        [19/11/2008|19:19] C:\Program Files\InstallShield Installation Information
        [11/12/2008|18:13] C:\Program Files\Internet Explorer
        [10/12/2006|14:13] C:\Program Files\Java
        [25/06/2007|16:19] C:\Program Files\Jeu petit
        [14/03/2008|10:43] C:\Program Files\JoWooD
        [15/01/2008|14:04] C:\Program Files\Kyodai
        [10/12/2006|14:13] C:\Program Files\Learn2.com
        [29/06/2008|13:29] C:\Program Files\Logitech
        [12/12/2008|13:11] C:\Program Files\Malwarebytes' Anti-Malware
        [18/07/2008|20:20] C:\Program Files\Maxis
        [13/08/2008|20:04] C:\Program Files\Messenger
        [03/02/2008|17:46] C:\Program Files\Micro Application
        [16/02/2007|12:53] C:\Program Files\Microids
        [27/06/2007|16:48] C:\Program Files\Microprose
        [20/08/2008|19:28] C:\Program Files\Microsoft ActiveSync
        [29/06/2008|16:17] C:\Program Files\Microsoft CAPICOM 2.1.0.2
        [10/12/2006|14:13] C:\Program Files\microsoft frontpage
        [27/01/2008|08:30] C:\Program Files\Microsoft Games
        [20/08/2008|19:27] C:\Program Files\Microsoft Office
        [04/11/2007|23:53] C:\Program Files\Microsoft Visual Studio
        [30/06/2008|02:02] C:\Program Files\Microsoft Works
        [21/05/2007|17:00] C:\Program Files\Microsoft.NET
        [01/03/2007|18:56] C:\Program Files\Monte Cristo
        [11/08/2008|17:25] C:\Program Files\Movie Maker
        [12/12/2008|21:06] C:\Program Files\Mozilla Firefox
        [29/06/2008|19:49] C:\Program Files\MSN
        [10/12/2006|14:13] C:\Program Files\MSN Gaming Zone
        [27/01/2008|08:33] C:\Program Files\MSXML 4.0
        [24/08/2008|15:45] C:\Program Files\Multi_Media_France
        [11/08/2008|17:23] C:\Program Files\NetMeeting
        [01/12/2008|09:38] C:\Program Files\Norton Internet Security
        [10/08/2008|13:48] C:\Program Files\NOS
        [10/12/2006|14:15] C:\Program Files\Online Services
        [11/08/2008|17:23] C:\Program Files\Outlook Express
        [06/08/2008|11:38] C:\Program Files\Picasa2
        [09/09/2007|14:08] C:\Program Files\Prison Tycoon
        [04/11/2007|23:53] C:\Program Files\Publication Web
        [10/12/2006|14:15] C:\Program Files\QuickTime
        [10/12/2006|14:13] C:\Program Files\Real
        [10/12/2006|14:13] C:\Program Files\Realtek
        [19/09/2008|20:12] C:\Program Files\Resounding
        [21/01/2008|17:10] C:\Program Files\SDLL
        [11/08/2008|13:17] C:\Program Files\Secured eMule
        [24/08/2008|16:13] C:\Program Files\Secured IE
        [11/08/2008|13:18] C:\Program Files\Secured_eMule
        [24/08/2008|16:13] C:\Program Files\securedie
        [10/12/2006|14:15] C:\Program Files\Services en ligne
        [24/08/2008|16:14] C:\Program Files\Share_Accelerator_MM
        [27/02/2008|22:28] C:\Program Files\Sierra
        [16/07/2007|11:42] C:\Program Files\Sierra On-Line
        [05/12/2008|23:01] C:\Program Files\Skype
        [16/07/2007|16:29] C:\Program Files\Smart Projects
        [10/12/2006|14:13] C:\Program Files\SmartSound Software
        [10/12/2006|14:13] C:\Program Files\Sonic
        [08/04/2007|09:10] C:\Program Files\Strategy First
        [26/08/2008|19:26] C:\Program Files\SweetIM
        [19/08/2008|18:01] C:\Program Files\Symantec
        [16/07/2007|14:45] C:\Program Files\Team17
        [19/11/2008|19:19] C:\Program Files\THQ
        [11/08/2008|12:22] C:\Program Files\torrent_search
        [12/12/2008|12:28] C:\Program Files\Trend Micro
        [23/06/2008|20:03] C:\Program Files\Ubisoft
        [10/12/2006|14:13] C:\Program Files\Ulead Systems
        [10/12/2006|14:13] C:\Program Files\Uninstall Information
        [29/11/2008|22:30] C:\Program Files\uTorrent
        [13/11/2008|10:40] C:\Program Files\VideoLAN
        [10/12/2006|14:13] C:\Program Files\Viewpoint
        [06/10/2008|23:15] C:\Program Files\VirtualDubMOD
        [26/10/2008|10:30] C:\Program Files\Wallpaper
        [26/03/2007|22:33] C:\Program Files\WinASPI
        [29/06/2008|12:53] C:\Program Files\Windows Live
        [12/12/2008|10:55] C:\Program Files\Windows Live Safety Center
        [10/12/2006|14:13] C:\Program Files\Windows Media Components
        [23/07/2008|08:49] C:\Program Files\Windows Media Connect 2
        [31/08/2008|00:15] C:\Program Files\Windows Media Player
        [11/08/2008|17:23] C:\Program Files\Windows NT
        [10/12/2006|14:13] C:\Program Files\Windows Plus
        [10/12/2006|14:13] C:\Program Files\WindowsUpdate
        [30/03/2007|17:02] C:\Program Files\WinRAR
        [13/05/2007|19:48] C:\Program Files\WinZip
        [10/12/2006|14:16] C:\Program Files\X10 Hardware
        [10/12/2006|14:13] C:\Program Files\xerox
        [01/12/2008|09:32] C:\Program Files\Xfire
        [24/08/2008|16:14] C:\Program Files\Zapu

        --------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

        [29/06/2008|14:47] C:\Program Files\Fichiers communs\Adobe
        [10/12/2006|14:14] C:\Program Files\Fichiers communs\AOL
        [10/12/2006|14:14] C:\Program Files\Fichiers communs\aolshare
        [04/11/2007|23:52] C:\Program Files\Fichiers communs\DESIGNER
        [29/06/2008|13:29] C:\Program Files\Fichiers communs\FotoWire
        [13/08/2008|12:56] C:\Program Files\Fichiers communs\Hewlett-Packard
        [13/08/2008|12:56] C:\Program Files\Fichiers communs\HP
        [10/12/2006|14:13] C:\Program Files\Fichiers communs\InstallShield
        [10/12/2006|14:13] C:\Program Files\Fichiers communs\Java
        [20/08/2008|19:28] C:\Program Files\Fichiers communs\L&H
        [29/06/2008|13:28] C:\Program Files\Fichiers communs\Logitech
        [20/08/2008|19:28] C:\Program Files\Fichiers communs\Microsoft Shared
        [10/12/2006|14:13] C:\Program Files\Fichiers communs\MSSoap
        [10/12/2006|14:13] C:\Program Files\Fichiers communs\Nullsoft
        [10/12/2006|14:13] C:\Program Files\Fichiers communs\ODBC
        [25/07/2008|05:55] C:\Program Files\Fichiers communs\Real
        [10/12/2006|14:14] C:\Program Files\Fichiers communs\Services
        [05/12/2008|23:01] C:\Program Files\Fichiers communs\Skype
        [10/12/2006|14:14] C:\Program Files\Fichiers communs\Sonic Shared
        [10/12/2006|14:13] C:\Program Files\Fichiers communs\SpeechEngines
        [10/12/2006|14:14] C:\Program Files\Fichiers communs\SureThing Shared
        [11/12/2008|18:18] C:\Program Files\Fichiers communs\Symantec Shared
        [11/08/2008|17:23] C:\Program Files\Fichiers communs\System
        [10/12/2006|14:13] C:\Program Files\Fichiers communs\TiVo Shared
        [10/12/2006|14:15] C:\Program Files\Fichiers communs\Ulead Systems
        [29/06/2008|12:52] C:\Program Files\Fichiers communs\WindowsLiveInstaller
        [25/07/2008|05:55] C:\Program Files\Fichiers communs\xing shared

        --------------------\\ Process

        ( 40 Processes )

        ... OK !

        --------------------\\ Recherche avec S_Lop

        Aucun fichier / dossier Lop trouvé !

        --------------------\\ Recherche de Fichiers / Dossiers Lop

        C:\DOCUME~1\ALLUSE~1\APPLIC~1\Htm Support Bait Deaf
        C:\DOCUME~1\ALLUSE~1\APPLIC~1\Htm Support Bait Deaf\Draw Free.exe
        C:\Program Files\BitTorrent Fastest Tool
        C:\Program Files\BitTorrent Fastest Tool\3wPlayer-2.0.0.0-setup.exe
        C:\Program Files\BitTorrent Fastest Tool\BitP.exe
        C:\Program Files\BitTorrent Fastest Tool\DWbrk03_0308.exe
        C:\Program Files\BitTorrent Fastest Tool\INSTALL.LOG
        C:\Program Files\Multi_Media_France
        C:\Program Files\Multi_Media_France\INSTALL.LOG
        C:\Program Files\Multi_Media_France
        C:\Program Files\Multi_Media_France\INSTALL.LOG

        --------------------\\ Verification du Registre

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Love Iso Rdr]
        "DisplayName"="CiD Help"
        "UninstallString"="C:\\DOCUME~1\\Cyrille\\APPLIC~1\\AIMSTY~1\\Slow real.exe -uninstall"

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

        --------------------\\ Verification du fichier Hosts

        Fichier Hosts PROPRE

        --------------------\\ Recherche de fichiers avec Catchme

        catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-12-12 21:21:41
        Windows 5.1.2600 Service Pack 3 NTFS
        scanning hidden processes ...
        scanning hidden files ...
        scan completed successfully
        hidden processes: 0
        hidden files: 17

        --------------------\\ Recherche d'autres infections

        Aucune autre infection trouvée !

        [F:5][D:1]-> C:\DOCUME~1\Cyrille\LOCALS~1\Temp
        [F:28][D:0]-> C:\DOCUME~1\Cyrille\Cookies
        [F:103][D:4]-> C:\DOCUME~1\Cyrille\LOCALS~1\TEMPOR~1\content.IE5

        1 - "C:\Lop SD\LopR_1.txt" - 12/12/2008|21:22 - Option : [1]

        --------------------\\ Fin du rapport a 21:22:32
        0
        2. jlpjlp Contributeur sécurité
          ok je te laisse finir ici destrio5?

          _____________

          pour avancer ce que j'avais fais

          relance lop sd puis

          * Choisis cette fois ci l'Option 2 (Suppression)
          * Ne ferme pas la fenêtre lors de la suppression !
          * Poste le rapport généré (C:\lopR.txt)

          (Si le Bureau ne réapparaît pas, presse Ctrl + Alt + Suppr , Onglet Fichier , Nouvelle tâche , tape explorer.exe et valide)

          ________________

          relance AD remover et choisir l'option B et cocher SWEETIM en mettant le chiffre correspondant a la ligne puis supprimer et coller le rapport

          ensuite pour la suite

          tu nous remets un rapport RSIT
          0
          1. X_Cyr
            Voici

            --------------------\\ Lop S&D 4.2.4-9c XP/Vista

            Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
            X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz )
            BIOS : Phoenix - AwardBIOS v6.00PG
            USER : Cyrille ( Administrator )
            BOOT : Normal boot
            Antivirus : Norton Internet Security 2006 2006 (Activated)
            Firewall : Norton Internet Security 2006 2006 (Activated)
            C:\ (Local Disk) - NTFS - Total:290 Go (Free:91 Go)
            D:\ (CD or DVD)
            F:\ (USB)
            G:\ (USB)
            H:\ (USB)
            I:\ (USB)

            "C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
            Option : [2] ( 12/12/2008|22:18 )

            \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

            Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Htm Support Bait Deaf\Draw Free.exe
            Supprime! - C:\Program Files\BitTorrent Fastest Tool\3wPlayer-2.0.0.0-setup.exe
            Supprime! - C:\Program Files\BitTorrent Fastest Tool\BitP.exe
            Supprime! - C:\Program Files\BitTorrent Fastest Tool\DWbrk03_0308.exe
            Supprime! - C:\Program Files\BitTorrent Fastest Tool\INSTALL.LOG
            Supprime! - C:\Program Files\Multi_Media_France\INSTALL.LOG
            Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Htm Support Bait Deaf
            Supprime! - C:\Program Files\BitTorrent Fastest Tool
            Supprime! - C:\Program Files\Multi_Media_France

            \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

            Supprime! - C:\Program Files\Viewpoint
            Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint

            \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

            --------------------\\ Listing des dossiers dans APPLIC~1

            [10/12/2006|14:13] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
            [10/12/2006|14:13] C:\DOCUME~1\ADMINI~1\APPLIC~1\Macromedia
            [10/12/2006|14:13] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
            [10/12/2006|14:13] C:\DOCUME~1\ADMINI~1\APPLIC~1\Mozilla
            [10/12/2006|14:14] C:\DOCUME~1\ADMINI~1\APPLIC~1\Symantec
            [10/12/2006|14:13] C:\DOCUME~1\ADMINI~1\APPLIC~1\You've Got Pictures Screensaver

            [11/12/2008|18:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{7DE2D9B5-C959-4D68-9E63-E73738EF6F02}
            [29/06/2008|14:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
            [04/08/2008|19:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\albumphoto
            [29/01/2008|16:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
            [11/08/2008|13:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BufferZone
            [25/05/2007|21:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
            [31/08/2008|00:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Downloaded Installations
            [16/01/2008|16:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
            [13/08/2008|12:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Hewlett-Packard
            [13/08/2008|12:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP
            [13/08/2008|12:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HP Product Assistant
            [13/08/2008|12:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\HPSSUPPLY
            [06/08/2008|17:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\IM
            [06/08/2008|17:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\IncrediMail
            [10/12/2006|14:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
            [12/12/2008|13:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
            [20/08/2008|19:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
            [10/08/2008|13:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NOS
            [04/09/2008|07:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
            [10/12/2006|14:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\OD2
            [29/06/2008|13:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
            [05/12/2008|23:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
            [10/12/2006|14:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SmartSound Software Inc
            [26/08/2008|19:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SweetIM
            [06/10/2008|07:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
            [10/12/2006|14:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ulead Systems
            [13/08/2008|13:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WEBREG
            [24/07/2008|11:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
            [29/06/2008|12:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
            [18/02/2007|15:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\X10 Settings
            [25/07/2008|11:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

            [08/08/2008|13:15] C:\DOCUME~1\Cyrille\APPLIC~1\Adobe
            [29/06/2008|14:50] C:\DOCUME~1\Cyrille\APPLIC~1\AdobeUM
            [30/03/2007|17:05] C:\DOCUME~1\Cyrille\APPLIC~1\Ahead
            [25/05/2007|21:38] C:\DOCUME~1\Cyrille\APPLIC~1\CyberLink
            [13/05/2008|18:25] C:\DOCUME~1\Cyrille\APPLIC~1\DivX
            [02/12/2008|14:22] C:\DOCUME~1\Cyrille\APPLIC~1\dvdcss
            [29/06/2008|13:29] C:\DOCUME~1\Cyrille\APPLIC~1\FotoWire
            [04/06/2008|15:53] C:\DOCUME~1\Cyrille\APPLIC~1\FUJIFILM
            [24/04/2008|13:33] C:\DOCUME~1\Cyrille\APPLIC~1\Greyfirst
            [04/09/2007|21:14] C:\DOCUME~1\Cyrille\APPLIC~1\Help
            [13/08/2008|19:30] C:\DOCUME~1\Cyrille\APPLIC~1\HP
            [10/12/2008|15:13] C:\DOCUME~1\Cyrille\APPLIC~1\HPAppData
            [10/12/2006|14:13] C:\DOCUME~1\Cyrille\APPLIC~1\Identities
            [26/08/2008|20:32] C:\DOCUME~1\Cyrille\APPLIC~1\Iminent
            [04/06/2008|15:49] C:\DOCUME~1\Cyrille\APPLIC~1\InstallShield
            [26/03/2007|21:46] C:\DOCUME~1\Cyrille\APPLIC~1\Leadertech
            [10/12/2006|14:13] C:\DOCUME~1\Cyrille\APPLIC~1\Macromedia
            [12/12/2008|13:00] C:\DOCUME~1\Cyrille\APPLIC~1\Malwarebytes
            [24/08/2008|16:07] C:\DOCUME~1\Cyrille\APPLIC~1\Microsoft
            [10/12/2006|14:13] C:\DOCUME~1\Cyrille\APPLIC~1\Mozilla
            [29/06/2008|19:50] C:\DOCUME~1\Cyrille\APPLIC~1\MSNInstaller
            [25/03/2007|11:16] C:\DOCUME~1\Cyrille\APPLIC~1\My Games
            [26/01/2007|17:27] C:\DOCUME~1\Cyrille\APPLIC~1\OD2
            [25/07/2008|09:40] C:\DOCUME~1\Cyrille\APPLIC~1\Real
            [05/12/2008|23:40] C:\DOCUME~1\Cyrille\APPLIC~1\Skype
            [05/12/2008|23:03] C:\DOCUME~1\Cyrille\APPLIC~1\skypePM
            [26/03/2007|21:46] C:\DOCUME~1\Cyrille\APPLIC~1\Sonic
            [26/03/2007|21:23] C:\DOCUME~1\Cyrille\APPLIC~1\Sun
            [31/08/2008|08:18] C:\DOCUME~1\Cyrille\APPLIC~1\Symantec
            [27/07/2007|19:56] C:\DOCUME~1\Cyrille\APPLIC~1\Ulead Systems
            [05/12/2008|23:48] C:\DOCUME~1\Cyrille\APPLIC~1\uTorrent
            [13/11/2008|10:43] C:\DOCUME~1\Cyrille\APPLIC~1\vlc
            [26/10/2008|10:57] C:\DOCUME~1\Cyrille\APPLIC~1\Wallpaper
            [30/11/2008|16:54] C:\DOCUME~1\Cyrille\APPLIC~1\Xfire
            [10/12/2006|14:13] C:\DOCUME~1\Cyrille\APPLIC~1\You've Got Pictures Screensaver

            [10/12/2006|14:13] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
            [10/12/2006|14:13] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Macromedia
            [10/12/2006|14:13] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
            [10/12/2006|14:13] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Mozilla
            [10/12/2006|14:14] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec
            [10/12/2006|14:13] C:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver

            [14/05/2008|01:15] C:\DOCUME~1\LOCALS~1\APPLIC~1\DivX
            [10/12/2006|14:13] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
            [10/12/2006|14:14] C:\DOCUME~1\LOCALS~1\APPLIC~1\X10 Commander

            [10/12/2006|14:13] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
            [12/12/2008|09:28] C:\DOCUME~1\NETWOR~1\APPLIC~1\X10 Commander

            --------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

            [12/12/2008 18:00][--a------] C:\WINDOWS\tasks\Configurer mon PC.job
            [12/12/2008 20:00][--a------] C:\WINDOWS\tasks\Norton AntiVirus - Effectuer une analyse complète du système - Cyrille.job
            [12/12/2008 18:00][--a------] C:\WINDOWS\tasks\Extension de garantie.job
            [12/12/2008 18:00][--a------] C:\WINDOWS\tasks\Master CD_DVD Creator.job
            [26/01/2007 17:17][--a------] C:\WINDOWS\tasks\Rappel d'enregistrement 2.job
            [12/12/2008 22:10][--ah-----] C:\WINDOWS\tasks\SA.DAT
            [10/08/2004 14:00][-rah-c---] C:\WINDOWS\tasks\desktop.ini

            --------------------\\ Listing des dossiers dans C:\Program Files

            [06/07/2008|21:51] C:\Program Files\2K Games
            [27/06/2007|15:02] C:\Program Files\3DO
            [10/12/2006|14:13] C:\Program Files\Adobe
            [12/12/2008|21:33] C:\Program Files\Ad-remover
            [30/03/2007|18:31] C:\Program Files\Ahead
            [28/08/2008|06:12] C:\Program Files\Aim Style Heart
            [02/12/2007|14:43] C:\Program Files\ANNO 1503 GOLD
            [03/02/2008|17:40] C:\Program Files\Anuman Interactive
            [29/01/2008|16:51] C:\Program Files\AOL 9.0
            [10/12/2006|14:14] C:\Program Files\AOL Compagnon
            [09/09/2007|14:07] C:\Program Files\Aquatic Tycoon
            [30/01/2007|10:50] C:\Program Files\Atari
            [09/03/2007|11:49] C:\Program Files\Bethesda Softworks
            [19/09/2008|20:22] C:\Program Files\Black Isle
            [16/10/2007|18:49] C:\Program Files\Browser Mouse
            [24/08/2008|16:27] C:\Program Files\BufferZone
            [12/12/2008|11:54] C:\Program Files\CCleaner
            [17/11/2008|17:07] C:\Program Files\Celtx
            [10/12/2006|14:13] C:\Program Files\Common Files
            [10/12/2006|14:13] C:\Program Files\ComPlus Applications
            [11/08/2008|12:22] C:\Program Files\Conduit
            [23/11/2008|17:06] C:\Program Files\ConTEXT
            [10/12/2008|11:22] C:\Program Files\CVitae
            [10/12/2006|14:13] C:\Program Files\CyberLink
            [16/02/2007|12:43] C:\Program Files\directx
            [18/08/2008|19:39] C:\Program Files\DivX
            [27/01/2008|15:11] C:\Program Files\Doom 3
            [29/10/2007|23:47] C:\Program Files\EasyPHP 2.0b1
            [11/12/2008|21:14] C:\Program Files\eMule
            [03/09/2007|13:09] C:\Program Files\EPSON
            [12/12/2008|22:09] C:\Program Files\Fichiers communs
            [12/12/2008|20:26] C:\Program Files\FindyKill
            [30/08/2008|23:51] C:\Program Files\FinePixViewerS
            [26/01/2007|17:45] C:\Program Files\Firaxis Games
            [03/01/2008|19:10] C:\Program Files\FireFly Studios
            [12/04/2007|21:14] C:\Program Files\Gabest
            [28/02/2008|13:28] C:\Program Files\glGo
            [27/11/2008|09:07] C:\Program Files\Google
            [12/08/2008|18:28] C:\Program Files\Hercules
            [13/08/2008|12:56] C:\Program Files\Hewlett-Packard
            [13/08/2008|12:58] C:\Program Files\HP
            [17/11/2007|12:00] C:\Program Files\IconColl
            [11/12/2008|18:17] C:\Program Files\Iminent
            [20/07/2007|13:43] C:\Program Files\Infogrames
            [04/11/2007|23:59] C:\Program Files\InstallShield
            [19/11/2008|19:19] C:\Program Files\InstallShield Installation Information
            [11/12/2008|18:13] C:\Program Files\Internet Explorer
            [10/12/2006|14:13] C:\Program Files\Java
            [25/06/2007|16:19] C:\Program Files\Jeu petit
            [14/03/2008|10:43] C:\Program Files\JoWooD
            [15/01/2008|14:04] C:\Program Files\Kyodai
            [10/12/2006|14:13] C:\Program Files\Learn2.com
            [29/06/2008|13:29] C:\Program Files\Logitech
            [12/12/2008|13:11] C:\Program Files\Malwarebytes' Anti-Malware
            [18/07/2008|20:20] C:\Program Files\Maxis
            [13/08/2008|20:04] C:\Program Files\Messenger
            [03/02/2008|17:46] C:\Program Files\Micro Application
            [16/02/2007|12:53] C:\Program Files\Microids
            [27/06/2007|16:48] C:\Program Files\Microprose
            [20/08/2008|19:28] C:\Program Files\Microsoft ActiveSync
            [29/06/2008|16:17] C:\Program Files\Microsoft CAPICOM 2.1.0.2
            [10/12/2006|14:13] C:\Program Files\microsoft frontpage
            [27/01/2008|08:30] C:\Program Files\Microsoft Games
            [20/08/2008|19:27] C:\Program Files\Microsoft Office
            [04/11/2007|23:53] C:\Program Files\Microsoft Visual Studio
            [30/06/2008|02:02] C:\Program Files\Microsoft Works
            [21/05/2007|17:00] C:\Program Files\Microsoft.NET
            [01/03/2007|18:56] C:\Program Files\Monte Cristo
            [11/08/2008|17:25] C:\Program Files\Movie Maker
            [12/12/2008|22:13] C:\Program Files\Mozilla Firefox
            [29/06/2008|19:49] C:\Program Files\MSN
            [10/12/2006|14:13] C:\Program Files\MSN Gaming Zone
            [27/01/2008|08:33] C:\Program Files\MSXML 4.0
            [11/08/2008|17:23] C:\Program Files\NetMeeting
            [01/12/2008|09:38] C:\Program Files\Norton Internet Security
            [10/08/2008|13:48] C:\Program Files\NOS
            [10/12/2006|14:15] C:\Program Files\Online Services
            [11/08/2008|17:23] C:\Program Files\Outlook Express
            [06/08/2008|11:38] C:\Program Files\Picasa2
            [09/09/2007|14:08] C:\Program Files\Prison Tycoon
            [04/11/2007|23:53] C:\Program Files\Publication Web
            [10/12/2006|14:15] C:\Program Files\QuickTime
            [10/12/2006|14:13] C:\Program Files\Real
            [10/12/2006|14:13] C:\Program Files\Realtek
            [19/09/2008|20:12] C:\Program Files\Resounding
            [21/01/2008|17:10] C:\Program Files\SDLL
            [11/08/2008|13:17] C:\Program Files\Secured eMule
            [24/08/2008|16:13] C:\Program Files\Secured IE
            [11/08/2008|13:18] C:\Program Files\Secured_eMule
            [24/08/2008|16:13] C:\Program Files\securedie
            [10/12/2006|14:15] C:\Program Files\Services en ligne
            [24/08/2008|16:14] C:\Program Files\Share_Accelerator_MM
            [27/02/2008|22:28] C:\Program Files\Sierra
            [16/07/2007|11:42] C:\Program Files\Sierra On-Line
            [05/12/2008|23:01] C:\Program Files\Skype
            [16/07/2007|16:29] C:\Program Files\Smart Projects
            [10/12/2006|14:13] C:\Program Files\SmartSound Software
            [10/12/2006|14:13] C:\Program Files\Sonic
            [08/04/2007|09:10] C:\Program Files\Strategy First
            [26/08/2008|19:26] C:\Program Files\SweetIM
            [19/08/2008|18:01] C:\Program Files\Symantec
            [16/07/2007|14:45] C:\Program Files\Team17
            [19/11/2008|19:19] C:\Program Files\THQ
            [11/08/2008|12:22] C:\Program Files\torrent_search
            [12/12/2008|12:28] C:\Program Files\Trend Micro
            [23/06/2008|20:03] C:\Program Files\Ubisoft
            [10/12/2006|14:13] C:\Program Files\Ulead Systems
            [10/12/2006|14:13] C:\Program Files\Uninstall Information
            [29/11/2008|22:30] C:\Program Files\uTorrent
            [13/11/2008|10:40] C:\Program Files\VideoLAN
            [06/10/2008|23:15] C:\Program Files\VirtualDubMOD
            [26/10/2008|10:30] C:\Program Files\Wallpaper
            [26/03/2007|22:33] C:\Program Files\WinASPI
            [29/06/2008|12:53] C:\Program Files\Windows Live
            [12/12/2008|10:55] C:\Program Files\Windows Live Safety Center
            [10/12/2006|14:13] C:\Program Files\Windows Media Components
            [23/07/2008|08:49] C:\Program Files\Windows Media Connect 2
            [31/08/2008|00:15] C:\Program Files\Windows Media Player
            [11/08/2008|17:23] C:\Program Files\Windows NT
            [10/12/2006|14:13] C:\Program Files\Windows Plus
            [10/12/2006|14:13] C:\Program Files\WindowsUpdate
            [30/03/2007|17:02] C:\Program Files\WinRAR
            [13/05/2007|19:48] C:\Program Files\WinZip
            [10/12/2006|14:16] C:\Program Files\X10 Hardware
            [10/12/2006|14:13] C:\Program Files\xerox
            [01/12/2008|09:32] C:\Program Files\Xfire
            [24/08/2008|16:14] C:\Program Files\Zapu

            --------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

            [29/06/2008|14:47] C:\Program Files\Fichiers communs\Adobe
            [10/12/2006|14:14] C:\Program Files\Fichiers communs\AOL
            [10/12/2006|14:14] C:\Program Files\Fichiers communs\aolshare
            [04/11/2007|23:52] C:\Program Files\Fichiers communs\DESIGNER
            [29/06/2008|13:29] C:\Program Files\Fichiers communs\FotoWire
            [13/08/2008|12:56] C:\Program Files\Fichiers communs\Hewlett-Packard
            [13/08/2008|12:56] C:\Program Files\Fichiers communs\HP
            [10/12/2006|14:13] C:\Program Files\Fichiers communs\InstallShield
            [10/12/2006|14:13] C:\Program Files\Fichiers communs\Java
            [20/08/2008|19:28] C:\Program Files\Fichiers communs\L&H
            [29/06/2008|13:28] C:\Program Files\Fichiers communs\Logitech
            [20/08/2008|19:28] C:\Program Files\Fichiers communs\Microsoft Shared
            [10/12/2006|14:13] C:\Program Files\Fichiers communs\MSSoap
            [10/12/2006|14:13] C:\Program Files\Fichiers communs\Nullsoft
            [10/12/2006|14:13] C:\Program Files\Fichiers communs\ODBC
            [25/07/2008|05:55] C:\Program Files\Fichiers communs\Real
            [10/12/2006|14:14] C:\Program Files\Fichiers communs\Services
            [05/12/2008|23:01] C:\Program Files\Fichiers communs\Skype
            [10/12/2006|14:14] C:\Program Files\Fichiers communs\Sonic Shared
            [10/12/2006|14:13] C:\Program Files\Fichiers communs\SpeechEngines
            [10/12/2006|14:14] C:\Program Files\Fichiers communs\SureThing Shared
            [11/12/2008|18:18] C:\Program Files\Fichiers communs\Symantec Shared
            [11/08/2008|17:23] C:\Program Files\Fichiers communs\System
            [10/12/2006|14:13] C:\Program Files\Fichiers communs\TiVo Shared
            [10/12/2006|14:15] C:\Program Files\Fichiers communs\Ulead Systems
            [29/06/2008|12:52] C:\Program Files\Fichiers communs\WindowsLiveInstaller
            [25/07/2008|05:55] C:\Program Files\Fichiers communs\xing shared

            --------------------\\ Process

            ( 51 Processes )

            ... OK !

            --------------------\\ Recherche avec S_Lop

            Aucun fichier / dossier Lop trouvé !

            --------------------\\ Recherche de Fichiers / Dossiers Lop

            Aucun fichier / dossier Lop trouvé !

            --------------------\\ Verification du Registre

            ..... OK !

            --------------------\\ Verification du fichier Hosts

            Fichier Hosts PROPRE

            --------------------\\ Recherche de fichiers avec Catchme

            catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
            Rootkit scan 2008-12-12 22:19:12
            Windows 5.1.2600 Service Pack 3 NTFS
            scanning hidden processes ...
            scanning hidden files ...
            scan completed successfully
            hidden processes: 0
            hidden files: 17

            --------------------\\ Recherche d'autres infections

            Aucune autre infection trouvée !

            [F:3][D:1]-> C:\DOCUME~1\Cyrille\LOCALS~1\Temp
            [F:28][D:0]-> C:\DOCUME~1\Cyrille\Cookies
            [F:10][D:2]-> C:\DOCUME~1\Cyrille\LOCALS~1\TEMPOR~1\content.IE5

            1 - "C:\Lop SD\LopR_1.txt" - 12/12/2008|21:22 - Option : [1]
            2 - "C:\Lop SD\LopR_2.txt" - 12/12/2008|22:19 - Option : [2]

            --------------------\\ Fin du rapport a 22:19:59
            0
          2. X_Cyr
            Voici le rapport RSIT:

            Ce qui m'ettone c'est qu'il n'y a que le fichier log et pas info.

            Logfile of random's system information tool 1.04 (written by random/random)
            Run by Cyrille at 2008-12-12 22:29:52
            Microsoft Windows XP Professionnel Service Pack 3
            System drive C: has 93 GB (31%) free of 297 GB
            Total RAM: 1022 MB (52% free)

            Logfile of Trend Micro HijackThis v2.0.2
            Scan saved at 22:29:56, on 12/12/2008
            Platform: Windows XP SP3 (WinNT 5.01.2600)
            MSIE: Internet Explorer v7.00 (7.00.6000.16762)
            Boot mode: Normal

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\system32\spoolsv.exe
            C:\Program Files\QuickTime\qttask.exe
            C:\WINDOWS\system32\ctfmon.exe
            C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
            C:\Program Files\Picasa2\PicasaMediaDetector.exe
            C:\Program Files\Wallpaper\Wallpaper.exe
            C:\Program Files\Iminent\imbooster.exe
            C:\Program Files\FinePixViewerS\QuickDCF2.exe
            C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
            C:\Program Files\Hercules\WiFi Station\WifiStation.exe
            C:\Documents and Settings\Cyrille\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
            C:\Program Files\Zapu\Zapu\wDivi.exe
            C:\Documents and Settings\Cyrille\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
            C:\xampp\xampp\apache\bin\apache.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\eHome\ehRecvr.exe
            C:\WINDOWS\eHome\ehSched.exe
            C:\WINDOWS\system32\svchost.exe
            C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
            C:\xampp\xampp\mysql\bin\mysqld-nt.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\system32\nvsvc32.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\system32\svchost.exe
            C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
            C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
            C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
            C:\xampp\xampp\apache\bin\apache.exe
            C:\WINDOWS\system32\dllhost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
            C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE
            C:\WINDOWS\explorer.exe
            C:\Documents and Settings\Cyrille\Bureau\RSIT.exe
            C:\Program Files\Trend Micro\HijackThis\Cyrille.exe

            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
            R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
            R3 - URLSearchHook: Secured_eMule toolbar - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - C:\Program Files\Secured_eMule\tbSecu.dll
            R3 - URLSearchHook: securedie Toolbar - {cd36797a-70f3-4acd-8825-623d3b896881} - C:\Program Files\securedie\tbsecu.dll
            R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
            O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
            O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
            O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
            O2 - BHO: Iminent.SearchTheWeb.HelperObject - {0E896FCA-D07E-45FE-901F-6A26FCF59C02} - mscoree.dll (file missing)
            O2 - BHO: Secured_eMule toolbar - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - C:\Program Files\Secured_eMule\tbSecu.dll
            O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
            O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
            O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
            O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
            O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
            O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\APPS\BAE\BAE.dll
            O2 - BHO: securedie Toolbar - {cd36797a-70f3-4acd-8825-623d3b896881} - C:\Program Files\securedie\tbsecu.dll
            O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
            O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
            O3 - Toolbar: Secured_eMule toolbar - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - C:\Program Files\Secured_eMule\tbSecu.dll
            O3 - Toolbar: securedie Toolbar - {cd36797a-70f3-4acd-8825-623d3b896881} - C:\Program Files\securedie\tbsecu.dll
            O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
            O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
            O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
            O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
            O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
            O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
            O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
            O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
            O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
            O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
            O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
            O4 - HKCU\..\Run: [Wallpaper] "C:\Program Files\Wallpaper\Wallpaper.exe" Starter
            O4 - HKCU\..\Run: [IMBooster] C:\Program Files\Iminent\imbooster.exe /warmup
            O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
            O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
            O4 - Startup: Outil de notification Live Search.lnk = Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
            O4 - Startup: Zapu Acceleration Engine.lnk = C:\Program Files\Zapu\Zapu\wincm.exe
            O4 - Startup: Zapu.lnk = C:\Program Files\Zapu\Zapu\wDivi.exe
            O4 - Global Startup: Exif Launcher S.lnk = ?
            O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
            O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
            O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
            O4 - Global Startup: WiFi Station.lnk = ?
            O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
            O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
            O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
            O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
            O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
            O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
            O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
            O14 - IERESET.INF: START_PAGE_URL=http://format.packardbell.com/cgi-bin/redirect/?country=FR&range=AD&phase=8&key=IESTART
            O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
            O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game10.zylom.com/activex/zylomgamesplayer.cab
            O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
            O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = skyson
            O17 - HKLM\Software\..\Telephony: DomainName = skyson
            O17 - HKLM\System\CCS\Services\Tcpip\..\{16D59095-99F6-4D1A-8B88-880639D6A718}: NameServer = 80.118.192.100,80.118.196.36
            O17 - HKLM\System\CCS\Services\Tcpip\..\{90D4FA0B-9A0F-4183-BA5B-014247BB8022}: NameServer = 212.30.96.108,212.30.124.146
            O17 - HKLM\System\CCS\Services\Tcpip\..\{AC5A431E-F610-4702-8195-53213055EABB}: NameServer = 212.30.96.108,212.30.124.146
            O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = skyson
            O17 - HKLM\System\CS1\Services\Tcpip\..\{16D59095-99F6-4D1A-8B88-880639D6A718}: NameServer = 80.118.192.100,80.118.196.36
            O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = skyson
            O17 - HKLM\System\CS2\Services\Tcpip\..\{16D59095-99F6-4D1A-8B88-880639D6A718}: NameServer = 80.118.192.100,80.118.196.36
            O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = skyson
            O17 - HKLM\System\CS3\Services\Tcpip\..\{16D59095-99F6-4D1A-8B88-880639D6A718}: NameServer = 80.118.192.100,80.118.196.36
            O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
            O23 - Service: Apache2.2 - Apache Software Foundation - C:\xampp\xampp\apache\bin\apache.exe
            O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
            O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
            O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
            O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
            O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
            O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
            O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
            O23 - Service: mysql - Unknown owner - C:\xampp\xampp\mysql\bin\mysqld-nt.exe
            O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
            O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
            O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
            O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
            O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
            O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
            0
        4. X_Cyr
          Voici pour ad remover :

          --------- Logfile of AD-Remover 1.0.7.5 by C_XX ---------

          *** Limited to ***

          Sweetim

          ******************

          # START at: 22:25:50 | Ven 12/12/2008 | Microsoft® Windows XP™ (v5.1.2600)
          # BOOT MODE: Normal

          # OPTION: Clean | EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat

          # PC: cyrillehome | USER: Cyrille ( Current user is an administrator)

          # DRIVE(S):
          - C:\ (File System: NTFS)

          # Internet Explorer v7.0.5730.13

          --------- [ RUNNING PROCESSES: 47 ] ---------

          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\csrss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\QuickTime\qttask.exe
          C:\WINDOWS\system32\rundll32.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
          C:\Program Files\Picasa2\PicasaMediaDetector.exe
          C:\Program Files\Wallpaper\Wallpaper.exe
          C:\Program Files\Iminent\imbooster.exe
          C:\Program Files\FinePixViewerS\QuickDCF2.exe
          C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
          C:\Program Files\Hercules\WiFi Station\WifiStation.exe
          C:\Documents and Settings\Cyrille\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
          C:\Program Files\Zapu\Zapu\wDivi.exe
          C:\Documents and Settings\Cyrille\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
          C:\xampp\xampp\apache\bin\apache.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\eHome\ehRecvr.exe
          C:\WINDOWS\eHome\ehSched.exe
          C:\WINDOWS\system32\svchost.exe
          C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
          C:\xampp\xampp\mysql\bin\mysqld-nt.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\nvsvc32.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\system32\svchost.exe
          C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
          C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
          C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
          C:\WINDOWS\ehome\mcrdsvc.exe
          C:\xampp\xampp\apache\bin\apache.exe
          C:\WINDOWS\system32\dllhost.exe
          C:\WINDOWS\System32\alg.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
          C:\WINDOWS\explorer.exe
          C:\WINDOWS\system32\ntvdm.exe

          -----------------------------------

          (!) ---- IE start pages reset

          +-----------------------| Sweetim Elements Deleted :

          "HKEY_CLASSES_ROOT\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847}"
          "HKEY_CLASSES_ROOT\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}"
          "HKEY_CLASSES_ROOT\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}"
          "HKEY_CLASSES_ROOT\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}"
          "HKEY_CLASSES_ROOT\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}"
          "HKEY_CLASSES_ROOT\Installer\Features\5D72AF385B5242D47B69FD47F2805AFC"
          "HKEY_CLASSES_ROOT\Installer\Features\428C9AFC877ABE7409DCBBD48BC23F84"
          "HKEY_CLASSES_ROOT\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0"
          "HKEY_CLASSES_ROOT\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632"
          "HKEY_CLASSES_ROOT\SWEETIE.IEToolbar"
          "HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1"
          "HKEY_CLASSES_ROOT\SWEETIE.SWEETIE"
          "HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3"
          "HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook"
          "HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1"
          "HKEY_CLASSES_ROOT\Toolbar3.SWEETIE"
          "HKEY_CLASSES_ROOT\Toolbar3.SWEETIE.1"
          "HKEY_CLASSES_ROOT\Typelib\{EEE6C35E-6118-11DC-9C72-001320C79847}"
          "HKEY_CLASSES_ROOT\Typelib\{EEE6C35F-6118-11DC-9C72-001320C79847}"
          "HKEY_CLASSES_ROOT\MgMediaPlayer.GifAnimator"
          "HKEY_CLASSES_ROOT\MgMediaPlayer.GifAnimator.1"
          "HKEY_CURRENT_USER\SOFTWARE\SweetIM"
          "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks" /v "{EEE6C35D-6118-11DC-9C72-001320C79847}"
          "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}"
          "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35B-6118-11DC-9C72-001320C79847}"
          "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{EEE6C35C-6118-11DC-9C72-001320C79847}"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\428C9AFC877ABE7409DCBBD48BC23F84"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\5D72AF385B5242D47B69FD47F2805AFC"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar" /v "{EEE6C35B-6118-11DC-9C72-001320C79847}"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CFA9C824-A778-47EB-90CD-BB4DB82CF348}"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{83FA27D5-25B5-4D24-B796-DF742F08A5CF}"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02F47BF73B948514FAACADD8CBBDF37D"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\080D9F5E1E95FEE4794CE438E635239E"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1E264E0A5959A1C46BA9175A878B12EA"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2E6768B6932D112438F047C54D180635"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\351716A953E21214898904032EAE2E81"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A189D17A469616C4688D23E192996267"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\34EDDB1BFB3A2D448845F3EFD0F15A43"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4318DF19719275242801CBE292063A4C"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB59FDB786388EA4D897F3EE715683AC"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EC65F200D112357449C8B1BC3CFA03D0"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F754C503375A13344B22388E18DFE87E"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\5D72AF385B5242D47B69FD47F2805AFC"
          "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\428C9AFC877ABE7409DCBBD48BC23F84"
          "HKEY_LOCAL_MACHINE\SOFTWARE\SweetIM"
          .
          [26/08/2008 19:26|d--------] C:\Program Files\SweetIM
          [26/08/2008 19:26|--a------] C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\searchplugins\sweetim.xml
          [26/08/2008 19:26|d--------] C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
          [27/08/2008 17:32|d--------] C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\SweetIMToolbarData
          [26/08/2008 19:26|d--------] C:\Documents and Settings\All Users\Application Data\SweetIM

          (!) ---- Temp files deleted.
          (!) ---- Recycle bin emptied in all drives.

          +-----------------------| ADDED SCAN :

          +---------- Scanning prefs.js ... ( # Mozilla User Preferences )

          ...\n9e00o1n.default\prefs.js :

          ~~~~ Mozilla FireFox version 2.0.0.18 ~~~~

          Start Page : "https://www.google.fr/?gws_rd=ssl"

          +----------+

          REMOVED - user_pref("browser.search.defaulturl", "https://search.sweetim.com/search.asp?src=2&q=");
          REMOVED - user_pref("sweetim.toolbar.highlight.colors", "#FFFF00,#00FFE4,#5AFF00,#0087FF,#FFCC00,#FF00F0");
          REMOVED - user_pref("sweetim.toolbar.logger.ConsoleHandler.MinReportLevel", "7");
          REMOVED - user_pref("sweetim.toolbar.logger.FileHandler.FileName", "ff-toolbar.log");
          REMOVED - user_pref("sweetim.toolbar.logger.FileHandler.MaxFileSize", "200000");
          REMOVED - user_pref("sweetim.toolbar.logger.FileHandler.MinReportLevel", "7");
          REMOVED - user_pref("sweetim.toolbar.mode.debug", "false");
          REMOVED - user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engine=\"http://*google.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"https://search.yahoo.com/*\" param=\"p=\" /><EXTERNAL_SEARCH engine=\"http://search.sweetim.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"http://*.live.*/*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"http://*youtube.com/\" param=\"search_query=\" /><EXTERNAL_SEARCH engine=\"http://*.ebay.*/search/*\" param=\"satitle=\" /><EXTERNAL_SEARCH engine=\"http://*.amazon.com/s/*\" param=\"field-keywords=\" /></TOOLBAR>");
          REMOVED - user_pref("sweetim.toolbar.search.history.capacity", "10");
          REMOVED - user_pref("sweetim.toolbar.simapp_id", "{C1A8DAC6-98BE-4301-BCD5-29354E23E244}");
          REMOVED - user_pref("sweetim.toolbar.version", "1.0.0.3");

          +---------------------------------------------------------------------------+

          +--[HKEY_CURRENT_USER\..\Run]

          ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe
          LDM REG_SZ C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
          LogitechSoftwareUpdate REG_SZ "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
          updateMgr REG_SZ C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
          Picasa Media Detector REG_SZ C:\Program Files\Picasa2\PicasaMediaDetector.exe
          Wallpaper REG_SZ "C:\Program Files\Wallpaper\Wallpaper.exe" Starter
          IMBooster REG_SZ C:\Program Files\Iminent\imbooster.exe /warmup

          +--[HKEY_LOCAL_MACHINE\..\Run]

          NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
          ccApp REG_SZ "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
          nwiz REG_SZ nwiz.exe /install
          hpqSRMon REG_SZ C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
          QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
          Symantec PIF AlertEng REG_SZ "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

          +--[HKEY_USERS\.DEFAULT\..\Run]

          CTFMON.EXE REG_SZ C:\WINDOWS\system32\CTFMON.EXE

          +--[HKEY_CURRENT_USER\..\Internet Explorer\MAIN]

          Start Page : hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

          +--[HKEY_LOCAL_MACHINE\..\Internet Explorer\MAIN]

          Start Page : hxxp://fr.msn.com/

          +---------------------------------------------------------------------------+

          - "C:\AD-report-12.12.2008.log" (15986 octets)

          [ END at: 22:26:41 | 12/12/2008 ] - [ Time elapsed: 51.5 seconds ]

          +---------------------------------------------------------------------------+
          +------------------------------- [ E.O.F - 195 lines ]
          +---------------------------------------------------------------------------+
          0
          1. jlpjlp Contributeur sécurité
            comme tu veux destrio5

            ________________

            colle le rapport d'un scan en ligne
            avec un des suivants:

            Panda en ligne :
            http://pandasoftware.fr

            Kaspersky en ligne
            https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
            0
            1. X_Cyr
              Aie, mamamia. Sa s' arrête jamais ? Et en plus c'était un scan rapide....

              ;***********************************************************************************************************************************************************************************
              ANALYSIS: 2008-12-12 23:08:42
              PROTECTIONS: 1
              MALWARE: 10
              SUSPECTS: 0
              ;***********************************************************************************************************************************************************************************
              PROTECTIONS
              Description Version Active Updated
              ;===================================================================================================================================================================================
              Norton Internet Security 2006 2006 Yes Yes
              ;===================================================================================================================================================================================
              MALWARE
              Id Description Type Active Severity Disinfectable Disinfected Location
              ;===================================================================================================================================================================================
              00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Cookies\cyrille@doubleclick[2].txt
              00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\cookies.txt[.doubleclick.net/]
              00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Cookies\cyrille@atdmt[2].txt
              00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\cookies.txt[.atdmt.com/]
              00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Cookies\cyrille@tradedoubler[2].txt
              00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\cookies.txt[.mediaplex.com/]
              00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\cookies.txt[.xiti.com/]
              00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Cookies\cyrille@ad.yieldmanager[1].txt
              00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\cookies.txt[.apmebf.com/]
              00168106 Cookie/Weborama TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Cookies\cyrille@weborama[1].txt
              00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\cookies.txt[.smartadserver.com/]
              00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\cookies.txt[.smartadserver.com/]
              00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\cookies.txt[.smartadserver.com/]
              00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\cookies.txt[.smartadserver.com/]
              03548697 Trj/Clicker.ALY Virus/Trojan No 1 No No C:\WINDOWS\system32\g37.exe[■%%\²ºÇ]
              ;===================================================================================================================================================================================
              SUSPECTS
              Sent Location 6
              ;===================================================================================================================================================================================
              ;===================================================================================================================================================================================
              VULNERABILITIES
              Id Severity Description 6
              ;===================================================================================================================================================================================
              ;===================================================================================================================================================================================
              0
            2. X_Cyr
              ;***********************************************************************************************************************************************************************************
              ANALYSIS: 2008-12-12 23:08:42
              PROTECTIONS: 1
              MALWARE: 10
              SUSPECTS: 0
              ;***********************************************************************************************************************************************************************************
              PROTECTIONS
              Description Version Active Updated
              ;===================================================================================================================================================================================
              Norton Internet Security 2006 2006 Yes Yes
              ;===================================================================================================================================================================================
              MALWARE
              Id Description Type Active Severity Disinfectable Disinfected Location
              ;===================================================================================================================================================================================
              00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Cookies\cyrille@doubleclick[2].txt
              00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\cookies.txt[.doubleclick.net/]
              00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Cookies\cyrille@atdmt[2].txt
              00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\cookies.txt[.atdmt.com/]
              00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Cookies\cyrille@tradedoubler[2].txt
              00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\cookies.txt[.mediaplex.com/]
              00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\cookies.txt[.xiti.com/]
              00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Cookies\cyrille@ad.yieldmanager[1].txt
              00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\cookies.txt[.apmebf.com/]
              00168106 Cookie/Weborama TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Cookies\cyrille@weborama[1].txt
              00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\cookies.txt[.smartadserver.com/]
              00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\cookies.txt[.smartadserver.com/]
              00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\cookies.txt[.smartadserver.com/]
              00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Documents and Settings\Cyrille\Application Data\Mozilla\Firefox\Profiles\n9e00o1n.default\cookies.txt[.smartadserver.com/]
              03548697 Trj/Clicker.ALY Virus/Trojan No 1 No No C:\WINDOWS\system32\g37.exe[■%%\²ºÇ]
              ;===================================================================================================================================================================================
              SUSPECTS
              Sent Location 6
              ;===================================================================================================================================================================================
              ;===================================================================================================================================================================================
              VULNERABILITIES
              Id Severity Description 6
              ;===================================================================================================================================================================================
              ;===================================================================================================================================================================================
              C'est mieux comme ca.
              Y parait que Norton est encore en route. Panda la détecté.
              0
            3. x_cyr
              suite à un CCleaner voila le dernier fichier : 

              ;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-12-13 00:02:31
PROTECTIONS: 1
MALWARE: 1
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
Norton Internet Security 2006                2006                          Yes       Yes
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
03548697  Trj/Clicker.ALY                    Virus/Trojan        No        1         No             No           C:\WINDOWS\system32\g37.exe[&#9632;%%\²ºÇ]
;===================================================================================================================================================================================
SUSPECTS
Sent      Location                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id        Severity   Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
;===================================================================================================================================================================================
;===================================================================================================================================================================================
              0
            4. x_cyr
              Non mais la j'y crois pas. J'ai rien fait à part me connecter à ce site et voila le résultat apres une deuxieme analyse : 
              -------------------------------------------------------------------------------
 KASPERSKY ON-LINE SCANNER REPORT
 Saturday, December 13, 2008 4:45:05 PM
 Système d'exploitation : Microsoft Windows XP Professional, Service Pack 3 (Build 2600)
 Kaspersky On-line Scanner version : 5.0.84.2
 Dernière mise à jour de la base antivirus Kaspersky : 13/12/2008
 Enregistrements dans la base antivirus Kaspersky : 1306711
-------------------------------------------------------------------------------

Paramètres d'analyse:
	Analyser avec la base antivirus suivante: standard
	Analyser les archives: vrai
	Analyser les bases de messagerie: vrai

Cible de l'analyse - Poste de travail:
	C:\
	D:\
	F:\
	G:\
	H:\
	I:\

Statistiques de l'analyse:
	Total d'objets analysés: 161229
	Nombre de virus trouvés: 6
	Nombre d'objets infectés: 9 / 0
	Nombre d'objets suspects: 0
	Durée de l'analyse: 02:41:26

Nom de l'objet infecté / Nom du virus / Dernière action

C:\Documents and Settings\Cyrille\Bureau\OTMoveIt3.exe	Infecté : Backdoor.Win32.SubSeven.asu	ignoré
C:\Lop SD\Backup-Lop\DOCUME~1\ALLUSE~1\APPLIC~1\Htm Support Bait Deaf\Draw Free.exe	Infecté : Trojan.Win32.Obfuscated.gen	ignoré
C:\Lop SD\Backup-Lop\Program Files\BitTorrent Fastest Tool\DWbrk03_0308.exe	Infecté : Trojan-Downloader.Win32.Agent.afyh	ignoré
C:\Program Files\eMule\Incoming\The Elder Scrolls Iv Oblivion Crack (Test Ok)..rar/Setup+Patch.exe	Infecté : Trojan-Dropper.Win32.Agent.aang	ignoré
C:\Program Files\eMule\Incoming\The Elder Scrolls Iv Oblivion Crack (Test Ok)..rar	CAB: infecté - 1	ignoré
C:\Qoobox\Quarantine\C\APPS\SMP\SMPSYS.EXE.vir	Infecté : Trojan-Downloader.Win32.Bagle.ahi	ignoré
C:\WINDOWS\system32\g37.exe/stream/data0002	Infecté : Trojan-Clicker.Win32.Agent.buj	ignoré
C:\WINDOWS\system32\g37.exe/stream	Infecté : Trojan-Clicker.Win32.Agent.buj	ignoré
C:\WINDOWS\system32\g37.exe	NSIS: infecté - 2	ignoré


Analyse terminée.


              J'ai deux autres PC qui vont sur internet. Et y a pas d'anti virus et ils n'ont pas de virus qui saoul.
              Je dois faire quoi maintenant ?
              Merci pour l'aide.
              0
          2. jlpjlp Contributeur sécurité
            ok les 3 premiers c'est rien!!!! le premier c'est otmovit qui est un faux positif! les deux suivant ont été mis en quarantaine par lop sd!!!

            C:\Documents and Settings\Cyrille\Bureau\OTMoveIt3.exe
            C:\Lop SD\Backup-Lop\DOCUME~1\ALLUSE~1\APPLIC~1\Htm Support Bait Deaf\Draw Free.exe
            C:\Lop SD\Backup-Lop\Program Files\BitTorrent Fastest Tool\DWbrk03_0308.exe

            vire ce qui est dans le dossier backup lop en allant dans psote de travail puis
            C:\Lop SD\Backup-Lop
            ________________

            ces deux là sont des cracks que tu tlécharge avec emule alors vire les deux fichiers et arrete de télécharger n'importe quoi!!!

            C:\Program Files\eMule\Incoming\The Elder Scrolls Iv Oblivion Crack (Test Ok)..rar/Setup+Patch.exe
            C:\Program Files\eMule\Incoming\The Elder Scrolls Iv Oblivion Crack (Test Ok)..rar

            _______________

            vire ce qui est dans le dossier quarantine en allant dans poste de travail puis

            C:\Qoobox\Quarantine\C\APPS\SMP\SMPSYS.EXE.vir

            _____________

            télécharge OTMoveIt
            http://oldtimer.geekstogo.com/OTMoveIt3.exe (de Old_Timer) sur ton Bureau.

            double-clique sur OTMoveIt.exe pour le lancer.
            copie la liste qui se trouve en citation ci-dessous,
            et colle-la dans le cadre de gauche de OTMoveIt :Paste instruction for items to be moved.
            (attention bien mettre :files)

            :files
            C:\WINDOWS\system32\g37.exe/stream/data0002
            C:\WINDOWS\system32\g37.exe/stream
            C:\WINDOWS\system32\g37.exe
            C:\Program Files\Aim Style Heart

            clique sur MoveIt! pour lancer la suppression.
            le résultat apparaitra dans le cadre "Results".
            clique sur Exit pour fermer.
            poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

            il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

            ________________________

            ensuite

            Télécharge ToolsCleaner sur ton bureau.
            --> http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
            # Clique sur Recherche et laisse le scan agir ...
            # Clique sur Suppression pour finaliser.
            # Tu peux, si tu le souhaites, te servir des Options facultatives.
            # Clique sur Quitter pour obtenir le rapport.
            # Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

            __________________________

            désactive la restauration système pour purger les virus qui seraient dedans (dans DEMARRER puis TOUS LES PROGRAMMES puis ACCESSOIRE puis OUTILS SYSTEME puis RESTAURATION SYSTEME puis paramètre)
            puis redémarre ton ordi puis réactive la
            _________________________

            réinstalle norton et dis si il marche

            remets un rapport RSIt et dis si encore des soucis
            0
            1. x_cyr
              Oui, pour Oblivion, je l'avais fait.

              Pour OtMoveIt j'ai un message d'erreur et pas de rapport :

              Invalid Time Flag! [data0002]
              Must be numerical

              Sinon, j'ai déjà réussi à réinstaller Norton et il fonctionne. (à 1ere vue)

              Reste plus qu'a installer ToolsCleaner.

              Mais pour E-mule je crois avoir compris la leçon.
              0
            2. x_cyr
              le rapport tools cleaner : 

              [ Rapport ToolsCleaner version 2.2.7 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\lopR.txt: trouvé !
C:\FindyKill.txt: trouvé !
C:\Combofix: trouvé !
C:\Lop SD: trouvé !
C:\Qoobox: trouvé !
C:\_OtMoveIt: trouvé !
C:\Rsit: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\Cyrille\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Cyrille\Bureau\LopSD.exe: trouvé !
C:\Documents and Settings\Cyrille\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\Cyrille\Bureau\OTMoveIt3.exe: trouvé !
C:\Documents and Settings\Cyrille\Bureau\Rsit.exe: trouvé !
C:\Documents and Settings\Cyrille\Menu Démarrer\Programmes\FindyKill: trouvé !
C:\Program Files\FindyKill: trouvé !
C:\Program Files\Ad-remover\TOOLS\NIRCMD.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
C:\WINDOWS\NIRCMD.exe: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\Cyrille\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\Cyrille\Bureau\LopSD.exe: supprimé !
C:\Documents and Settings\Cyrille\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\lopR.txt: supprimé !
C:\FindyKill.txt: supprimé !
C:\Documents and Settings\Cyrille\Bureau\OTMoveIt3.exe: supprimé !
C:\Documents and Settings\Cyrille\Bureau\Rsit.exe: supprimé !
C:\Program Files\Ad-remover\TOOLS\NIRCMD.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\WINDOWS\NIRCMD.exe: supprimé !
C:\Combofix: supprimé !
C:\Lop SD: supprimé !
C:\Qoobox: supprimé !
C:\_OtMoveIt: supprimé !
C:\Rsit: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Documents and Settings\Cyrille\Menu Démarrer\Programmes\FindyKill: supprimé !
C:\Program Files\FindyKill: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

Fichiers temporaires nettoyés !
Corbeille vidée!
              0
            3. x_cyr
              Le rapport Rsit : 

              Logfile of random's system information tool 1.04 (written by random/random)
Run by Cyrille at 2008-12-13 23:32:57
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 93 GB (31%) free of 297 GB
Total RAM: 1022 MB (63% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:33:30, on 13/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\xampp\xampp\apache\bin\apache.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\xampp\xampp\mysql\bin\mysqld-nt.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\xampp\xampp\apache\bin\apache.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Iminent\imbooster.exe
C:\Program Files\FinePixViewerS\QuickDCF2.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Hercules\WiFi Station\WifiStation.exe
C:\Documents and Settings\Cyrille\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
C:\Program Files\Zapu\Zapu\wDivi.exe
C:\Documents and Settings\Cyrille\Application Data\Microsoft\Live Search\Mise-a-jour-LiveSearch.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\LVComsX.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Cyrille\Bureau\RSIT.exe
C:\Program Files\trend micro\Cyrille.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Secured_eMule toolbar - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - C:\Program Files\Secured_eMule\tbSecu.dll
R3 - URLSearchHook: securedie Toolbar - {cd36797a-70f3-4acd-8825-623d3b896881} - C:\Program Files\securedie\tbsecu.dll
R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Iminent.SearchTheWeb.HelperObject - {0E896FCA-D07E-45FE-901F-6A26FCF59C02} - mscoree.dll (file missing)
O2 - BHO: Secured_eMule toolbar - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - C:\Program Files\Secured_eMule\tbSecu.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\APPS\BAE\BAE.dll
O2 - BHO: securedie Toolbar - {cd36797a-70f3-4acd-8825-623d3b896881} - C:\Program Files\securedie\tbsecu.dll
O3 - Toolbar: Secured_eMule toolbar - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - C:\Program Files\Secured_eMule\tbSecu.dll
O3 - Toolbar: securedie Toolbar - {cd36797a-70f3-4acd-8825-623d3b896881} - C:\Program Files\securedie\tbsecu.dll
O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [Wallpaper] "C:\Program Files\Wallpaper\Wallpaper.exe" Starter
O4 - HKCU\..\Run: [IMBooster] C:\Program Files\Iminent\imbooster.exe /warmup
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de notification Live Search.lnk = Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
O4 - Startup: Zapu Acceleration Engine.lnk = C:\Program Files\Zapu\Zapu\wincm.exe
O4 - Startup: Zapu.lnk = C:\Program Files\Zapu\Zapu\wDivi.exe
O4 - Global Startup: Exif Launcher S.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: WiFi Station.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Livre de reliures HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Sélection intelligente HP - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://format.packardbell.com/cgi-bin/redirect/?country=FR&range=AD&phase=8&key=IESTART
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game10.zylom.com/activex/zylomgamesplayer.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = skyson
O17 - HKLM\Software\..\Telephony: DomainName = skyson
O17 - HKLM\System\CCS\Services\Tcpip\..\{16D59095-99F6-4D1A-8B88-880639D6A718}: NameServer = 80.118.192.100,80.118.196.36
O17 - HKLM\System\CCS\Services\Tcpip\..\{90D4FA0B-9A0F-4183-BA5B-014247BB8022}: NameServer = 212.30.96.108,212.30.124.146
O17 - HKLM\System\CCS\Services\Tcpip\..\{AC5A431E-F610-4702-8195-53213055EABB}: NameServer = 212.30.96.108,212.30.124.146
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = skyson
O17 - HKLM\System\CS1\Services\Tcpip\..\{16D59095-99F6-4D1A-8B88-880639D6A718}: NameServer = 80.118.192.100,80.118.196.36
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = skyson
O17 - HKLM\System\CS2\Services\Tcpip\..\{16D59095-99F6-4D1A-8B88-880639D6A718}: NameServer = 80.118.192.100,80.118.196.36
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = skyson
O17 - HKLM\System\CS3\Services\Tcpip\..\{16D59095-99F6-4D1A-8B88-880639D6A718}: NameServer = 80.118.192.100,80.118.196.36
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: Apache2.2 - Apache Software Foundation - C:\xampp\xampp\apache\bin\apache.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: mysql - Unknown owner - C:\xampp\xampp\mysql\bin\mysqld-nt.exe
O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 13976 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Configurer mon PC.job
C:\WINDOWS\tasks\Extension de garantie.job
C:\WINDOWS\tasks\Master CD_DVD Creator.job
C:\WINDOWS\tasks\Norton AntiVirus - Effectuer une analyse complète du système - Cyrille.job
C:\WINDOWS\tasks\Rappel d'enregistrement 2.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0347C33E-8762-4905-BF09-768834316C61}]
HP Print Enhancer - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll [2007-03-02 1298024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{053F9267-DC04-4294-A72C-58F732D338C0}]
HP Print Clips - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll [2007-03-02 177768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0E896FCA-D07E-45FE-901F-6A26FCF59C02}]
Iminent.SearchTheWeb.HelperObject - C:\WINDOWS\system32\mscoree.dll [2007-04-13 271360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1d1b60fd-b21f-4b9a-8a5f-64e8544828d7}]
Secured_eMule toolbar - C:\Program Files\Secured_eMule\tbSecu.dll [2007-05-27 1326104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-07-25 308856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4596013b-6c31-408b-a266-deae5c086dc2}]
Share Accelerator MM Toolbar - C:\Program Files\Share_Accelerator_MM\tbShar.dll [2007-12-10 1510424]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9ECB9560-04F9-4bbc-943D-298DDF1699E1}]
CNisExtBho Class - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll [2005-10-22 94336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A8F38D8D-E480-4D52-B7A2-731BB6995FDD}]
CNavExtBho Class - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll [2007-06-07 140912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]
CBrowserHelperObject Object - C:\APPS\BAE\BAE.dll [2006-06-23 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cd36797a-70f3-4acd-8825-623d3b896881}]
securedie Toolbar - C:\Program Files\securedie\tbsecu.dll [2007-09-06 1453080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - Secured_eMule toolbar - C:\Program Files\Secured_eMule\tbSecu.dll [2007-05-27 1326104]
{cd36797a-70f3-4acd-8825-623d3b896881} - securedie Toolbar - C:\Program Files\securedie\tbsecu.dll [2007-09-06 1453080]
{4596013b-6c31-408b-a266-deae5c086dc2} - Share Accelerator MM Toolbar - C:\Program Files\Share_Accelerator_MM\tbShar.dll [2007-12-10 1510424]
{0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - Norton Internet Security 2006 - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll [2005-10-22 94336]
{C4069E3A-68F1-403E-B40E-20066696354B} - Norton AntiVirus - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll [2007-06-07 140912]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-04-27 7573504]
"nwiz"=nwiz.exe /install []
"hpqSRMon"=C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [2008-08-20 150016]
"QuickTime Task"=C:\Program Files\QuickTime\qttask.exe [2006-11-09 98304]
"ccApp"=C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe [2005-09-16 52848]
"URLLSTCK.exe"=C:\Program Files\Norton Internet Security\UrlLstCk.exe [2007-02-01 23168]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"LDM"=C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe [2008-06-29 20480]
"LogitechSoftwareUpdate"=C:\Program Files\Logitech\Video\ManifestEngine.exe [2005-06-08 196608]
"updateMgr"=C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [2006-03-30 313472]
"Picasa Media Detector"=C:\Program Files\Picasa2\PicasaMediaDetector.exe [2008-02-26 443968]
"Wallpaper"=C:\Program Files\Wallpaper\Wallpaper.exe [2007-08-21 233472]
"IMBooster"=C:\Program Files\Iminent\imbooster.exe [2008-11-26 415232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AOL ACS"=2

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage
Exif Launcher S.lnk - C:\Program Files\FinePixViewerS\QuickDCF2.exe
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
WiFi Station.lnk - C:\Program Files\Hercules\WiFi Station\WifiStation.exe

C:\Documents and Settings\Cyrille\Menu Démarrer\Programmes\Démarrage
Outil de notification Live Search.lnk - C:\Documents and Settings\Cyrille\Application Data\Microsoft\Live Search\Notification-LiveSearch.exe
Zapu Acceleration Engine.lnk - C:\Program Files\Zapu\Zapu\wincm.exe
Zapu.lnk - C:\Program Files\Zapu\Zapu\wDivi.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll [2008-04-14 240128]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDrives"=0
"NoDriveAutoRun"=67108863

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%ProgramFiles%\AOL 9.0\aol.exe"="%ProgramFiles%\AOL 9.0\aol.exe:*:Enabled:AOL"
"%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\logo_ubi.exe"="%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\logo_ubi.exe:*:Enabled:SPLINTER CELL PANDORA"
"%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\pandora.exe"="%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\pandora.exe:*:Enabled:PANDORA"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe"="C:\Program Files\Firaxis Games\Sid Meier's Civilization 4\Civilization4.exe:*:Enabled:Sid Meier's Civilization 4"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\Program Files\Microprose\Risk II\RiskII.exe"="C:\Program Files\Microprose\Risk II\RiskII.exe:*:Enabled:Risk II"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\Program Files\Microsoft Visual Studio\COMMON\Tools\VS-Ent98\Vanalyzr\VARPC.EXE"="C:\Program Files\Microsoft Visual Studio\COMMON\Tools\VS-Ent98\Vanalyzr\VARPC.EXE:*:Enabled:Microsoft (R) Visual Studio VSA RPC Event Creator"
"C:\Program Files\AOL 9.0\waol.exe"="C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL 9.0"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\backWeb-8876480.exe:*:Enabled:Logitech Desktop Messenger"
"C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Zapu\Zapu\wDivi.exe"="C:\Program Files\Zapu\Zapu\wDivi.exe:*:Enabled:Zapu Control"
"C:\Documents and Settings\Cyrille\Local Settings\Temp\WZSE0.TMP\SymNRT.exe"="C:\Documents and Settings\Cyrille\Local Settings\Temp\WZSE0.TMP\SymNRT.exe:*:Enabled:Norton Removal Tool"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\AOL 9.0\waol.exe"="C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL 9.0"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqpse.exe:*:Enabled:hpqpse.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqsudi.exe:*:Enabled:hpqsudi.exe"
"C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe:*:Enabled:hpqpsapp.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eb2f0708-4cf7-11dd-b45d-001b2faed07a}]
shell\AutoRun\command - E:\memorybar.exe


======List of files/folders created in the last 1 months======

2008-12-13 23:32:57 ----D---- C:\rsit
2008-12-13 23:19:25 ----A---- C:\TCleaner.txt
2008-12-13 23:19:10 ----D---- C:\WINDOWS\Temp
2008-12-13 21:03:32 ----D---- C:\Documents and Settings\Cyrille\Application Data\Symantec
2008-12-13 20:36:45 ----D---- C:\Program Files\Norton Internet Security
2008-12-13 20:35:51 ----A---- C:\WINDOWS\system32\S32EVNT1.DLL
2008-12-13 20:35:22 ----D---- C:\Program Files\Symantec
2008-12-13 20:35:17 ----D---- C:\Documents and Settings\All Users\Application Data\Symantec
2008-12-13 17:37:30 ----A---- C:\WINDOWS\ntbtlog.txt
2008-12-13 13:32:10 ----D---- C:\WINDOWS\system32\Kaspersky Lab
2008-12-12 23:02:30 ----D---- C:\Program Files\Panda Security
2008-12-12 22:26:37 ----SHD---- C:\RECYCLER
2008-12-12 21:32:51 ----D---- C:\Program Files\Ad-remover
2008-12-12 13:39:14 ----A---- C:\WINDOWS\SWREG.exe
2008-12-12 13:39:13 ----A---- C:\WINDOWS\zip.exe
2008-12-12 13:39:13 ----A---- C:\WINDOWS\VFIND.exe
2008-12-12 13:39:13 ----A---- C:\WINDOWS\SWXCACLS.exe
2008-12-12 13:39:13 ----A---- C:\WINDOWS\SWSC.exe
2008-12-12 13:39:13 ----A---- C:\WINDOWS\sed.exe
2008-12-12 13:39:13 ----A---- C:\WINDOWS\grep.exe
2008-12-12 13:39:13 ----A---- C:\WINDOWS\fdsv.exe
2008-12-12 13:39:11 ----D---- C:\WINDOWS\ERDNT
2008-12-12 13:00:28 ----D---- C:\Documents and Settings\Cyrille\Application Data\Malwarebytes
2008-12-12 13:00:23 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-12-12 13:00:23 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-12-12 12:28:50 ----D---- C:\Program Files\Trend Micro
2008-12-12 11:54:45 ----D---- C:\Program Files\CCleaner
2008-12-12 10:51:38 ----D---- C:\Program Files\Windows Live Safety Center
2008-12-11 18:17:05 ----HD---- C:\Documents and Settings\All Users\Application Data\{7DE2D9B5-C959-4D68-9E63-E73738EF6F02}
2008-12-11 18:06:53 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
2008-12-11 18:01:49 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2008-12-11 18:01:13 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2008-12-11 18:01:02 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2008-12-10 23:16:09 ----A---- C:\debug.txt
2008-12-05 23:02:03 ----D---- C:\Documents and Settings\Cyrille\Application Data\Skype
2008-12-05 23:01:36 ----D---- C:\Program Files\Skype
2008-12-05 23:01:35 ----D---- C:\Program Files\Fichiers communs\Skype
2008-12-04 11:08:59 ----A---- C:\WINDOWS\Iedit.INI
2008-11-29 22:01:44 ----D---- C:\Program Files\uTorrent
2008-11-29 22:01:39 ----D---- C:\Documents and Settings\Cyrille\Application Data\uTorrent
2008-11-23 17:02:33 ----D---- C:\Program Files\ConTEXT
2008-11-23 16:35:26 ----D---- C:\xampp
2008-11-20 21:44:26 ----A---- C:\WINDOWS\system32\xfcodec.dll
2008-11-19 19:23:43 ----A---- C:\WINDOWS\system32\psfind.dll
2008-11-18 22:43:17 ----D---- C:\Documents and Settings\Cyrille\Application Data\dvdcss
2008-11-17 16:59:58 ----D---- C:\Program Files\Celtx

======List of files/folders modified in the last 1 months======

2008-12-13 23:33:06 ----D---- C:\Program Files\Fichiers communs\Symantec Shared
2008-12-13 23:30:42 ----D---- C:\Program Files\Mozilla Firefox
2008-12-13 23:19:10 ----AD---- C:\WINDOWS
2008-12-13 23:18:25 ----RD---- C:\Program Files
2008-12-13 21:32:25 ----D---- C:\WINDOWS\Tasks
2008-12-13 21:32:09 ----D---- C:\WINDOWS\Registration
2008-12-13 21:32:02 ----D---- C:\WINDOWS\system32\CatRoot2
2008-12-13 21:31:20 ----HD---- C:\Config.Msi
2008-12-13 21:30:11 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-12-13 21:17:05 ----SHD---- C:\WINDOWS\Installer
2008-12-13 21:16:27 ----D---- C:\Program Files\Fichiers communs
2008-12-13 21:16:23 ----D---- C:\WINDOWS\system32\drivers
2008-12-13 21:16:23 ----D---- C:\WINDOWS\system32
2008-12-13 21:01:08 ----SHD---- C:\DRIVERS
2008-12-13 13:32:10 ----D---- C:\WINDOWS\inf
2008-12-13 13:32:10 ----D---- C:\WINDOWS\Downloaded Program Files
2008-12-12 23:13:05 ----SHD---- C:\System Volume Information
2008-12-12 23:13:05 ----D---- C:\WINDOWS\system32\Restore
2008-12-12 23:03:59 ----D---- C:\WINDOWS\Prefetch
2008-12-12 22:10:08 ----A---- C:\WINDOWS\system.ini
2008-12-12 22:09:00 ----D---- C:\WINDOWS\AppPatch
2008-12-12 20:18:00 ----D---- C:\Autre
2008-12-12 13:42:49 ----D---- C:\WINDOWS\system32\config
2008-12-12 11:56:03 ----D---- C:\WINDOWS\Minidump
2008-12-12 11:56:03 ----AD---- C:\WINDOWS\Debug
2008-12-12 11:35:24 ----AC---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-12-12 10:40:45 ----ASH---- C:\BOOT.INI
2008-12-12 09:10:26 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2008-12-11 21:14:22 ----D---- C:\Program Files\eMule
2008-12-11 18:17:44 ----D---- C:\Program Files\Iminent
2008-12-11 18:17:28 ----RSD---- C:\WINDOWS\assembly
2008-12-11 18:13:28 ----D---- C:\Program Files\Internet Explorer
2008-12-11 18:04:56 ----RSHD---- C:\WINDOWS\system32\dllcache
2008-12-11 18:04:45 ----D---- C:\WINDOWS\ie7updates
2008-12-11 18:04:37 ----HD---- C:\WINDOWS\$hf_mig$
2008-12-10 15:13:30 ----D---- C:\Documents and Settings\Cyrille\Application Data\HPAppData
2008-12-10 11:22:46 ----D---- C:\Program Files\CVitae
2008-12-10 00:24:37 ----A---- C:\WINDOWS\system32\MRT.exe
2008-12-05 23:03:52 ----D---- C:\Documents and Settings\Cyrille\Application Data\skypePM
2008-12-05 23:01:38 ----D---- C:\Documents and Settings\All Users\Application Data\Skype
2008-12-01 09:32:18 ----SD---- C:\Program Files\Xfire
2008-11-30 16:54:54 ----D---- C:\Documents and Settings\Cyrille\Application Data\Xfire
2008-11-29 19:31:24 ----AC---- C:\WINDOWS\mdm.ini
2008-11-27 09:08:02 ----D---- C:\APPS
2008-11-27 09:07:52 ----D---- C:\Program Files\Google
2008-11-27 09:07:18 ----D---- C:\Photos
2008-11-19 19:23:52 ----D---- C:\WINDOWS\system32\DirectX
2008-11-19 19:19:57 ----D---- C:\Program Files\THQ
2008-11-19 19:19:52 ----HD---- C:\Program Files\InstallShield Installation Information
2008-11-14 16:28:15 ----D---- C:\WINDOWS\Help

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 cdrbsvsd;cdrbsvsd; C:\WINDOWS\system32\drivers\cdrbsvsd.sys [2003-12-03 13566]
R1 eeCtrl;Symantec Eraser Control driver; \??\C:\Program Files\Fichiers communs\Symantec Shared\EENGINE\eeCtrl.sys []
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40576]
R1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
R1 prodrv06;StarForce Protection Environment Driver v6; C:\WINDOWS\System32\drivers\prodrv06.sys [2004-05-13 79488]
R1 SAVRTPEL;SAVRTPEL; \??\C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVRTPEL.SYS []
R1 SPBBCDrv;SPBBCDrv; \??\C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCDrv.sys []
R1 SYMTDI;SYMTDI; C:\WINDOWS\System32\Drivers\SYMTDI.SYS [2007-10-01 189320]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.5.3.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2008-08-12 21419]
R2 Aspi32;Aspi32; C:\WINDOWS\system32\drivers\Aspi32.sys [1999-09-10 25244]
R2 NwlnkIpx;Protocole de transport compatible NWLink IPX/SPX/NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys [2008-04-13 88320]
R2 NwlnkNb;NetBIOS NWLink; C:\WINDOWS\system32\DRIVERS\nwlnknb.sys [2004-08-10 63232]
R2 NwlnkSpx;Protocole NWLink SPX/SPXII; C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys [2004-08-10 55936]
R2 symlcbrd;symlcbrd; \??\C:\WINDOWS\system32\drivers\symlcbrd.sys []
R3 3xHybrid;ASUSTek SAA713x PCI Card; C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2006-04-28 882688]
R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv; \??\C:\Program Files\Fichiers communs\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys []
R3 FETND5BV;VIA Rhine-Family Fast Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2006-06-12 43008]
R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-05-16 4275712]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
R3 NAVENG;NAVENG; \??\C:\PROGRA~1\FICHIE~1\SYMANT~1\VIRUSD~1\20081213.002\NAVENG.Sys []
R3 NAVEX15;NAVEX15; \??\C:\PROGRA~1\FICHIE~1\SYMANT~1\VIRUSD~1\20081213.002\NavEx15.Sys []
R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-04-27 3663040]
R3 RT61;802.11g Wireless Driver RT61; C:\WINDOWS\system32\DRIVERS\RT61.sys [2006-12-01 395648]
R3 SAVRT;SAVRT; \??\C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVRT.SYS []
R3 SYMDNS;SYMDNS; C:\WINDOWS\System32\Drivers\SYMDNS.SYS [2007-10-01 12680]
R3 SymEvent;SymEvent; \??\C:\Program Files\Symantec\SYMEVENT.SYS []
R3 SYMFW;SYMFW; C:\WINDOWS\System32\Drivers\SYMFW.SYS [2007-10-01 98184]
R3 SYMIDS;SYMIDS; C:\WINDOWS\System32\Drivers\SYMIDS.SYS [2007-10-01 31624]
R3 SYMIDSCO;SYMIDSCO; \??\C:\PROGRA~1\FICHIE~1\SYMANT~1\SymcData\idsdefs\20081210.002\symidsco.sys []
R3 SYMNDIS;SYMNDIS; C:\WINDOWS\System32\Drivers\SYMNDIS.SYS [2007-10-01 28040]
R3 SYMREDRV;SYMREDRV; C:\WINDOWS\System32\Drivers\SYMREDRV.SYS [2007-10-01 23944]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Concentrateur USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 wanatw;WAN Miniport (ATW); C:\WINDOWS\system32\DRIVERS\wanatw4.sys [2003-01-10 33588]
R3 X10Hid;X10 Hid Device; C:\WINDOWS\System32\Drivers\x10hid.sys [2005-11-28 7040]
R3 XUIF;X10 USB Wireless Transceiver; C:\WINDOWS\System32\Drivers\x10ufx2.sys [2005-05-19 17792]
S3 Bridge;Pont MAC; C:\WINDOWS\system32\DRIVERS\bridge.sys [2008-04-13 71552]
S3 BridgeMP;Miniport de pont MAC; C:\WINDOWS\system32\DRIVERS\bridge.sys [2008-04-13 71552]
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 gsplittm;gsplittm; \??\C:\DOCUME~1\Cyrille\LOCALS~1\Temp\gsplittm.sys []
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2007-03-08 49920]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2007-03-08 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2007-03-08 21568]
S3 LVUSBSta;Logitech USB Monitor Filter; C:\WINDOWS\system32\drivers\lvusbsta.sys [2005-01-31 22016]
S3 MHNDRV;Pilote MHN; C:\WINDOWS\system32\DRIVERS\mhndrv.sys [2004-08-10 11008]
S3 MPE;Filtre BDA MPE; C:\WINDOWS\system32\DRIVERS\MPE.sys [2008-04-13 15232]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 PID_0928;Logitech QuickCam Express(PID_0928); C:\WINDOWS\system32\DRIVERS\LV561AV.SYS [2005-01-31 211712]
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 SONYPVU1;Pilote de filtrage Sony USB (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
S3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 WPN111;Wireless USB 2.0 Adapter with RangeMax Service; C:\WINDOWS\system32\DRIVERS\WPN111.sys [2005-09-26 362944]
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S4 sr;Pilote de filtre de restauration système; C:\WINDOWS\system32\DRIVERS\sr.sys [2008-04-14 73600]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apache2.2;Apache2.2; C:\xampp\xampp\apache\bin\apache.exe [2008-06-14 17408]
R2 ccEvtMgr;Symantec Event Manager; C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe [2005-09-16 192112]
R2 ccProxy;Symantec Network Proxy; C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe [2005-09-16 202352]
R2 ccSetMgr;Symantec Settings Manager; C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe [2005-09-16 169584]
R2 ehRecvr;Media Center Receiver Service; C:\WINDOWS\eHome\ehRecvr.exe [2006-10-09 237568]
R2 ehSched;Service de planification Media Center; C:\WINDOWS\eHome\ehSched.exe [2005-08-05 103424]
R2 hpqddsvc;Service HP CUE DeviceDiscovery; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 McrdSvc;Media Center Extender Service; C:\WINDOWS\ehome\mcrdsvc.exe [2005-08-05 99328]
R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 mysql;mysql; C:\xampp\xampp\mysql\bin\mysqld-nt.exe [2008-08-04 5779456]
R2 navapsvc;Service Norton AntiVirus Auto-Protect; C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe [2007-05-28 139888]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-04-27 143426]
R2 Planificateur LiveUpdate automatique;Planificateur LiveUpdate automatique; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2006-08-03 100032]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 SNDSrvc;Symantec Network Drivers Service; C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe [2007-10-01 214408]
R2 SPBBCSvc;Symantec SPBBCSvc; C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe [2005-09-15 1160800]
R2 Symantec Core LC;Symantec Core LC; C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe [2008-12-13 1251720]
R2 UleadBurningHelper;Ulead Burning Helper; C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe [2005-01-31 49152]
R2 USBDeviceService;USBDeviceService; C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe [2005-10-20 90112]
R2 x10nets;X10 Device Network Service; C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe [2001-11-12 20480]
R3 hpqcxs08;hpqcxs08; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 NSCService;Norton Protection Center Service; C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE [2006-12-15 750720]
S3 aspnet_state;Service d'état ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-04-13 33632]
S3 ccISPwdSvc;Symantec Internet Security Password Validation; C:\Program Files\Norton Internet Security\ccPwdSvc.exe [2007-02-20 72328]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-04-13 68952]
S3 comHost;COM Host; C:\Program Files\Norton Internet Security\comHost.exe [2007-02-01 45696]
S3 getPlus(R) Helper;getPlus(R) Helper; C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2008-06-26 31592]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-04 136120]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2006-08-03 2119360]
S3 MHN;MHN; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 SAVScan;Symantec AVScan; C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe [2005-08-26 198368]
S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S3 Visual Studio Analyzer RPC bridge;Visual Studio Analyzer RPC bridge; C:\Program Files\Microsoft Visual Studio\Common\Tools\VS-Ent98\Vanalyzr\varpc.exe [1998-06-06 34036]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-03 918016]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 AOL ACS;AOL Connectivity Service; C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe [2004-04-08 1135728]

-----------------EOF-----------------


              J'ai relancé Norton et il a détecté d'autres virus. J'en ai viré un mais il reste toujours le G37.exe
              Voici le rapport ;
              Résultats d'analyse :
              --------------------------------------------------------------------------------
              Heure de début d'analyse13/12/2008 21:52:28

              Durée de l'analyse : 77 minutes 45 secondes

              Eléments analysés: 638607
              Sections de registre: 11445
              Aucune action effectuée: 483
              Fichiers: 625892
              Echec de la suppression: 2
              Détecté: 1
              Aucune action effectuée: 76
              Processus: 49
              Aucune action requise: 2
              Fichiers batch: 9
              Fichiers INI: 5
              Services: 1006
              Programmes au démarrage: 20
              Type COM: 89
              HOSTS: 90
              Fournisseurs de services multicouches: 2
              Menaces corrigées: 1
              Détails
              SecurityRisk.Cmdow : Exclu
              Analyse manuelle
              Catégorie de risque : Risque de sécurité
              Impact global du risque : Faible
              Performances : Faible
              Confidentialité : Faible
              Suppression : Faible
              Furtivité : Faible
              Cliquez pour plus d'informations sur ce risque : SecurityRisk.Cmdow
              Action effectuée : Exclu
              Description : Zones affectées :
              1 fichiers :
              C:\Program Files\Ad-remover\TOOLS\cmdow.exe - Exclu

              Menaces restantes: 2
              Détails
              Dialer.Stardial : Echec de la suppression
              Analyse manuelle
              Catégorie de risque : Numéroteur
              Impact global du risque : Elevé
              Performances : Elevé
              Confidentialité : Elevé
              Suppression : Elevé
              Furtivité : Elevé
              Cliquez pour plus d'informations sur ce risque : Dialer.Stardial
              Action effectuée : Echec de la suppression
              Description : Zones affectées :
              1 fichiers :
              Railroad Tycoon 3.exe dans Railroad Tycoon III + crack no cd\Railroad Tycoon 3.crack nocd keygen.zip dans C:\Program Files\eMule\Incoming\Jeux cycy\Railroad Tycoon III + crack no cd.rar - Echec de la suppression

              Adware.Begin2search : Echec de la suppression
              Analyse manuelle
              Catégorie de risque : Logiciel publicitaire
              Impact global du risque : Elevé
              Performances : Elevé
              Confidentialité : Moyen
              Suppression : Elevé
              Furtivité : Elevé
              Cliquez pour plus d'informations sur ce risque : Adware.Begin2search
              Action effectuée : Echec de la suppression
              Description : Zones affectées :
              1 fichiers :
              C:\WINDOWS\system32\g37.exe - Echec de la suppression

              9 clés de registre :
              HKEY_USERS\S-1-5-21-3961666731-3408890296-1442537433-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D27CDB6E-AE6D-11CF-96B8-444553540000} - Aucune action effectuée
              HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\Search Bar - Aucune action effectuée
              HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar - Aucune action effectuée
              HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar - Aucune action effectuée
              HKEY_USERS\S-1-5-21-3961666731-3408890296-1442537433-500\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar - Aucune action effectuée
              HKEY_USERS\S-1-5-21-3961666731-3408890296-1442537433-1005\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar - Aucune action effectuée
              HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\Search Bar - Aucune action effectuée
              HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\Search Page - Aucune action effectuée
              HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\Search Page - Aucune action effectuée

              Voila, voila... Il en reste plus qu'un et Norton Fonctionne. Je suis heureux.
              0
          3. jlpjlp Contributeur sécurité
            vire les barres de recherche :
            securedie Toolbar
            Share Accelerator MM Toolbar

            via ton panneau de configuration

            _________________

            Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked".

            O2 - BHO: Iminent.SearchTheWeb.HelperObject - {0E896FCA-D07E-45FE-901F-6A26FCF59C02} - mscoree.dll (file missing)
            O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
            O4 - Startup: Zapu Acceleration Engine.lnk = C:\Program Files\Zapu\Zapu\wincm.exe
            O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

            ____________________

            mettre à jour adobe reader
            https://acrobat.adobe.com/fr/fr/acrobat/pdf-reader.html

            _________________
            mets a jour java:
            Télécharge JavaRa.zip de Paul 'Prm753' McLain et Fred de Vries.
            Décompresse le fichier sur ton bureau (clique droit > Extraire tout.)
            Double-clique sur le répertoire JavaRa obtenu.
            Puis double-clique sur le fichier JavaRa.exe (le .exe peut ne pas s'afficher)
            Clique sur Search For Updates.
            Sélectionne Update Using jucheck.exe puis clique sur Search.
            Autorise le processus à se connecter s'il te le demande, clique sur Install et suis les instructions d'installation. Cela prendra quelques minutes.
            Quand l'installation est terminée, revient à l'écran de JavaRa et clique sur Remove Older Versions.
            Clique sur Oui pour confirmer. L'outil va travailler, clique ensuite sur Ok, puis une deuxième fois sur Ok.
            Un rapport va s'ouvrir, copie-colle le dans ta prochaine réponse.
            Note : le rapport se trouve aussi à la racine de la partition système, en général C:\ sous le nom JavaRa.log
            (c:\JavaRa.log)
            Ferme l'application.

            si cela ne fonctionne pas

            https://www.java.com/fr/download/windows_manual.jsp?locale=fr&host=www.java.com:80

            tu peux désinstaller les vieilles versions.

            __________________

            télécharges et installes :

            kill box
            https://www.bleepingcomputer.com/download/linux/

            aide kill box
            http://perso.wanadoo.fr/jesses/Docs/Logiciels/KillBox.htm

            - Redémarre en mode sans échec, si tu sais pas comment on fait lis ceci

            - Double-clic sur fix.reg

            Ouvres killbox
            - Sélectionne "delete on reboot"
            - Clique sur le dossier jaune à droite et sélectionne le fichier : C:\WINDOWS\system32\g37.exe
            - Clique sur la croix rouge et et blanche
            - Répond yes et laisse redémarrer ton pc.
            N'hésite pas à consulter l'Aide killbox

            Vérifie que le fichier C:\WINDOWS\system32\g37.exe n'est plus présent.

            __________________________

            verifie avec norton en mode sans echec aussi qu'il ne reste rien

            ___________________________

            encore des soucis???
            0
            1. gbgbgb
              bonjour,

              j'ai été infecté par winupgro, j'ai passé toute la journée à lire des forums et essayer plein de trucs, mais la je suis bloqué.

              Je n'arrive pas à lancer ComboFix ("combofix.exe n'est pas une application valide"..) meme en mode sans echec
              les seuls que j'ai pu faire fonctionner sont elibagla, malwarebytes, et hijack this

              Est ce que vous auriez une idée pour que je puisse lancer combofix?
              merci beaucoup
              0

              Discussions similaires

              Softonic,est-ce un virus ?
              techmel1

              6 réponses
              Chrome://newtab
              Nova

              14 réponses
              Désinstaller Softonic
              Diguimette

              5 réponses
              Supprimer New Tab
              tysaozon

              8 réponses
              Virus dans filezilla
              balnelius10

              9 réponses