VIRUS!!!! besoin d'aide...

Tu trouveras Java ici :
https://www.java.com/fr/

bonjour, je n arrive pas a mettre a jour javara via juchex. lorsque je clique rechercher, rien ne se produit...
que dois-je faire

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
C:\WINDOWS\system32\e727e009-.txt moved successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3ABCEDAE-CD5D-41A5-BF51-40F4233B97BA}\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\prunnet deleted successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\prunnet deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cbXRKBqq\\ deleted successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\etilqs_wWLbGTk6G7Db1go1Y4gc scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\hpodvd09.log scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\_hphtra07.log scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\~DFA587.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\iiuwlhea.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\iiuwlhea.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\iiuwlhea.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\iiuwlhea.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\iiuwlhea.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\iiuwlhea.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01142009_184414

Files moved on Reboot...
File C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\etilqs_wWLbGTk6G7Db1go1Y4gc not found!
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\hpodvd09.log moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\_hphtra07.log moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\~DFA587.tmp moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\iiuwlhea.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\iiuwlhea.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\iiuwlhea.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\iiuwlhea.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\iiuwlhea.default\urlclassifier3.sqlite moved successfully.
C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Mozilla\Firefox\Profiles\iiuwlhea.default\XUL.mfl moved successfully.

voici rapport moveit

1/

---> Désactive ton antivirus le temps de la manipulation car OTMoveIt3 est détecté comme une infection à tort.

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau :
http://oldtimer.geekstogo.com/OTMoveIt3.exe

---> Double-clique sur OTMoveIt3.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant ci-dessous :

:processes
explorer.exe

:files
C:\WINDOWS\system32\e727e009-.txt

:reg
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3ABCEDAE-CD5D-41A5-BF51-40F4233B97BA}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"prunnet"=-
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"prunnet"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cbXRKBqq]

:commands
[purity]
[emptytemp]
[reboot]

---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

2/

---> Supprime les traces de Norton avec ceci :
ftp://ftp.symantec.com/public/francais/removal_tools/Norton_Removal_Tool.exe

---> Mets à jour Adobe Reader :
https://acrobat.adobe.com/fr/fr/acrobat/pdf-reader.html

---> Mets à jour Internet Explorer :
http://www.microsoft.com/downloads/details.aspx?FamilyId=9AE91EBE-3385-447C-8A30-081805B2F90B&displaylang=fr

Vu que tu as le SP3, tu dois faire une petite modification pour installer Internet Explorer 7 :
http://www.technos-sources.com/tutorial-installer-ie7-apres-avoir-installe-sp3-windows-xp-98.aspx

3/

---> Télécharge JavaRa.zip (de Paul 'Prm753' McLain et Fred de Vries) sur ton Bureau.
* Décompresse le fichier sur le Bureau (Clic droit > Extraire tout).
* Double-clique sur le répertoire JavaRa.
* Puis double-clique sur le fichier JavaRa.exe (le exe peut ne pas s'afficher).
* Choisis Français puis clique sur Select.
* Clique sur Recherche de mises à jour.
* Sélectionne Mettre à jour via jucheck.exe puis clique sur Rechercher.
* Autorise le processus à se connecter s'il le demande, clique sur Installer et suis les instructions d'installation qui prennent quelques minutes.
* L'installation est terminée, reviens à l'écran de JavaRa et clique sur Effacer les anciennes versions.
* Clique sur Oui pour confirmer. Laisse travailler et clique ensuite sur OK, puis une deuxième fois sur OK.
* Un rapport va s'ouvrir. Poste-le dans ta prochaine réponse.
* Ferme l'application.

Note : le rapport se trouve aussi dans C:\ sous le nom JavaRa.log.

voici le lien demandé

http://www.virustotal.com/fr/analisis/50bc64223b69821bfc3d88c7925197be

....en fait, ce n est pas un lien mais bien l adresse de la page demandé.... mes connaissances limités en informatique ne me permette pas de posté un lien..... s il faut obligatoirement un lien, il faudrait m expliquer la marche a suivre

merci

---> Fais analyser ce fichier : C:\WINDOWS\system32CmdLineExt.dll

---> Sur VirusTotal et poste le lien de l'analyse :
https://www.virustotal.com/gui/

info.txt logfile of random's system information tool 1.05 2009-01-12 21:01:29

======Uninstall list======

-->C:\Program Files\Nero\Nero8\\nero\uninstall\UNNERO.exe /UNINSTALL
-->C:\WINDOWS\IsUn040c.exe -fC:\WINDOWS\orun32.isu
-->c:\WINDOWS\system32\\MSIEXEC.EXE /x {F80239D8-7811-4D5E-B033-0D0BBFE32920}
-->C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
-->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
-->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
-->C:\WINDOWS\UNRecode.exe /UNINSTALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Acrobat 4.0-->C:\WINDOWS\ISUN040C.EXE -f"C:\Program Files\Fichiers communs\Adobe\Acrobat 4.0\NT\Uninst.isu" -c"C:\Program Files\Fichiers communs\Adobe\Acrobat 4.0\NT\Uninst.dll"
Adobe Anchor Service CS3-->MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3-->MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
Adobe Bridge CS3-->MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge Start Meeting-->MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe Camera Raw 4.0-->MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps-->MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Color - Photoshop Specific-->MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}
Adobe Color Common Settings-->MsiExec.exe /I{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}
Adobe Color EU Recommended Settings-->MsiExec.exe /I{73B5D990-04EA-4751-B10F-5534770B91F2}
Adobe Color JA Extra Settings-->MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}
Adobe Color NA Extra Settings-->MsiExec.exe /I{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}
Adobe Default Language CS3-->MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
Adobe Device Central CS3-->MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
Adobe Download Manager 2.0 (Remove Only)-->"C:\Program Files\Fichiers communs\Adobe\ESD\uninst.exe"
Adobe ExtendScript Toolkit 2-->MsiExec.exe /I{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Fonts All-->MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}
Adobe Help Viewer CS3-->MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}
Adobe Linguistics CS3-->MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
Adobe PDF Library Files-->MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Photoshop CS3-->C:\Program Files\Fichiers communs\Adobe\Installers\32e9033392a51340b32fdc6ad893ab7\Setup.exe
Adobe Photoshop CS3-->MsiExec.exe /I{BF794769-8875-4E01-B7BE-E00104604F4A}
Adobe Reader 7.0.9 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A70900000002}
Adobe Setup-->MsiExec.exe /I{926DEB4E-2B0A-4C5C-AE4A-BF6C06949702}
Adobe Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Adobe Stock Photos CS3-->MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}
Adobe Type Support-->MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3-->MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Version Cue CS3 Client-->MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
Adobe XMP Panels CS3-->MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}
Agere Systems PCI-SV92PP Soft Modem-->agrsmdel
AnyDVD-->"C:\Program Files\SlySoft\AnyDVD\AnyDVD-uninst.exe" /D="C:\Program Files\SlySoft\AnyDVD"
ArcSoft PhotoStudio 5.5-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{85309D89-7BE9-4094-BB17-24999C6118FC}\SETUP.EXE" -l0x40c
ArcSoft Software Suite-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0684EECC-380C-4B97-8C51-5BDB9E4D679C}\setup.exe" -l0x40c
Assistant de connexion Windows Live-->MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
Asterix at the Olympic Games-->"C:\Program Files\Atari\Asterix at the Olympic Games\Uninstall.exe"
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir PersonalEdition Classic\SETUP.EXE /REMOVE
Babylon-->C:\Program Files\Babylon\Babylon-Pro\Utils\uninstbb.exe
Barbie Beach Vacation-->"C:\Program Files\Fichiers communs\Barbie\Uninstall\ISUninst.exe" -f"C:\Program Files\Barbie(tm)\Beach Vacation(tm)\DeIsL1.isu"
Barbie(TM) as The Princess and the Pauper-->C:\Program Files\Fichiers communs\Vivendi Universal Games\Uninstall\PPauperUn.exe
Barbie® As Sleeping Beauty-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Barbie®\Barbie® As Sleeping Beauty\Uninst.isu"
BitComet 0.85-->C:\Program Files\BitComet\uninst.exe
Bookworm Deluxe-->"C:\Program Files\Zylom Games\Bookworm Deluxe\GameInstaller.exe" --uninstall UnInstall.log
CamfrogWEB Advanced ActiveX Plugin (remove only)-->"C:\Program Files\CFWebAdvancedU\Uninstall.exe"
Canon Camera Access Library-->"C:\Program Files\Fichiers communs\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CAL\Uninst.ini"
Canon Camera Support Core Library-->"C:\Program Files\Fichiers communs\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CSCLIB\Uninst.ini"
Canon Camera Window DC_DV 5 for ZoomBrowser EX-->"C:\Program Files\Fichiers communs\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowDVC\Uninst.ini"
Canon Camera Window DC_DV 6 for ZoomBrowser EX-->"C:\Program Files\Fichiers communs\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowDVC6\Uninst.ini"
Canon Camera Window MC 6 for ZoomBrowser EX-->"C:\Program Files\Fichiers communs\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowMC\Uninst.ini"
Canon G.726 WMP-Decoder-->"C:\Program Files\Fichiers communs\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\G726Decoder\G726DecUnInstall.ini"
Canon MovieEdit Task for ZoomBrowser EX-->"C:\Program Files\Fichiers communs\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\ZoomBrowser EX\Program\MVWUninst.ini"
Canon MP Navigator 2.0-->"C:\Program Files\Canon\MP Navigator 2.0\Maint.exe" /UninstallRemove C:\Program Files\Canon\MP Navigator 2.0\uninst.ini
Canon MP170-->"C:\WINDOWS\system32\CanonMP Uninstaller Information\{91175441-4E5D-4e13-B116-828FD352CDB2}\DelDrv.exe" /U:{91175441-4E5D-4e13-B116-828FD352CDB2} /L0x000c
Canon RAW Image Task for ZoomBrowser EX-->"C:\Program Files\Fichiers communs\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\RAW Image Task\Uninst.ini"
Canon RemoteCapture Task for ZoomBrowser EX-->"C:\Program Files\Fichiers communs\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\RemoteCaptureTask DC\Uninst.ini"
Canon Utilities Easy-PhotoPrint-->C:\Program Files\Canon\Easy-PhotoPrint\uninst.exe uninst.ini
Canon Utilities EOS Utility-->"C:\Program Files\Fichiers communs\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\EOS Utility\Uninst.ini"
Canon Utilities PhotoStitch-->"C:\Program Files\Fichiers communs\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\PhotoStitch\Uninst.ini"
Canon Utilities ZoomBrowser EX-->"C:\Program Files\Fichiers communs\Canon\UIW\1.0.0.0\Uninst.exe" "C:\Program Files\Canon\ZoomBrowser EX\Program\Uninst.ini"
CloneDVD2-->"C:\Program Files\Elaborate Bytes\CloneDVD2\CloneDVD2-uninst.exe" /D="C:\Program Files\Elaborate Bytes\CloneDVD2"
Compatibility Pack for the 2007 Office system-->MsiExec.exe /X{90120000-0020-040C-0000-0000000FF1CE}
Correctif pour le Lecteur Windows Media [Voir Q828026 pour plus d'informations]-->C:\WINDOWS\$NtUninstallQ828026$\spuninst\spuninst.exe
Correctif pour Lecteur Windows Media 10 (KB910393)-->"C:\WINDOWS\$NtUninstallKB910393$\spuninst\spuninst.exe"
Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Disney Princess Magical Dress-Up-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{77E6AE74-357C-4B33-8324-FDDC9997B4D1}\setup.exe" -l0x9
Easy-WebPrint-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Canon\Easy-WebPrint\Uninst.isu"
ebgcInfra-->MsiExec.exe /X{82ACA6FB-E81B-4C01-8D8F-B15ACD663E34}
ebgcRes-->MsiExec.exe /X{79159A4E-1DD4-4FEA-9FDD-E94B7C5DDA47}
ebgcSDK-->MsiExec.exe /X{4D60D0AC-E1E5-44A4-8C3F-516112AEC53F}
Encyclopédie Microsoft Encarta 2006-->MsiExec.exe /I{06180048-3E21-46D6-9A91-D927BA08F41D}
Enhanced Multimedia Keyboard Solution-->C:\HP\KBD\Install.exe /remove
Extension de Windows Live Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{0CA6047C-D28B-4295-834A-07C52BA20C2D}
Galerie de photos Windows Live-->MsiExec.exe /X{A70FA218-6598-4AC9-813D-63597C5DD068}
GdiplusUpgrade-->MsiExec.exe /I{5421155F-B033-49DB-9B33-8F80F233D4D5}
GemMaster Mystic-->"C:\Program Files\GemMasterFrench\uninstallgemmaster.exe"
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
Google Toolbar for Internet Explorer-->MsiExec.exe /I{DBEA1034-5882-4A88-8033-81C4EF0CFA29}
Google Toolbar for Internet Explorer-->regsvr32 /u /s "c:\program files\google\googletoolbar1.dll"
High Definition Audio - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
HP Appareils photos Photosmart 6.0-->C:\Program Files\HP\Digital Imaging\{5D61626A-BD55-4e42-82EE-4AE89D8FD050}\setup\hpzscr01.exe -datfile hpiscr01.dat
HP Boot Optimizer-->MsiExec.exe /X{1341D838-719C-4A05-B50F-49420CA1B4BB}
HP Deskjet Printer Preload-->MsiExec.exe /I{2C5D07FB-31A2-4F2D-9FDA-0B24ACD42BD0}
HP DigitalMedia Archive-->MsiExec.exe /X{F80239D8-7811-4D5E-B033-0D0BBFE32920}
HP Document Viewer 6.1-->C:\Program Files\HP\Digital Imaging\DocumentViewer\hpzscr01.exe -datfile hpqbud04.dat
HP DVD Play 2.1-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{45D707E9-F3C4-11D9-A373-0050BAE317E1}\Setup.exe" -uninstall
HP Imaging Device Functions 7.0-->C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
HP Photosmart 330,380,420,470,7800,8000,8200 Series-->C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\setup\hpzscr01.exe -d MsiRollbackUninstaller -datfile hphscr08.dat
HP Photosmart for Media Center PC-->c:\Program Files\HP\Digital Imaging\bin\mcpc\setupmcl.exe /u
HP Photosmart Premier Software 6.5-->C:\Program Files\HP\Digital Imaging\uninstall\hpzscr01.exe -datfile hpqscr01.dat
HP PSC & OfficeJet 5.3.B-->"C:\Program Files\HP\Digital Imaging\{5B79CFD1-6845-4158-9D7D-6BE89DF2C135}\setup\hpzscr01.exe" -datfile hposcr07.dat
HP PSC & OfficeJet 6.1.A-->"C:\Program Files\HP\Digital Imaging\{E5A8DDAB-AE80-48C6-A75B-D0FAB83B299D}\setup\hpzscr01.exe" -datfile hposcr08.dat
HP Solution Center and Imaging Support Tools 6.1-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
iGamebar-->C:\Program Files\igamebar\uninstall.exe -uninstall -prompt
Insaniquarium Deluxe 1.0-->C:\Program Files\PopCap Games\Insaniquarium Deluxe\PopUninstall.exe "C:\Program Files\PopCap Games\Insaniquarium Deluxe\Install.log"
J2SE Runtime Environment 5.0 Update 9-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150090}
K-Lite Codec Pack 3.5.0 Full-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
La ferme en folie-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{4162D37F-14D6-495A-BE76-35DA9402E29A} /l1036
Lapin Malin Maternelle 1-->C:\WINDOWS\unin040c.exe -fC:\TLCWIN\RRT\uninstal\DeIsL1.isu
Laser Sensor Mouse-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{235C3A50-559F-4CAA-BAC3-4CC9ABF51976}\setup.exe" -l0x9 -removeonly
Le Monde de Nemo-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{3B26434C-FFA8-4A9C-A9C9-E8EE9C4E89D4} NemoADVUninstall
Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
LimeWire 4.16.6-->"C:\Program Files\LimeWire\uninstall.exe"
LiveUpdate Notice (Symantec Corporation)-->MsiExec.exe /X{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}
Lyra Personal Audio Player (RD1021/1071/1075)-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7F3D9322-E392-411F-81EB-3F844B56248B}\setup.exe" -l0x9
Macromedia Flash Player 8-->MsiExec.exe /X{6815FCDD-401D-481E-BA88-31B4754C2B46}
Mahjongg Master Egyptian Edition-->C:\PROGRA~1\EGAMES~1\MAHJON~1\UNWISE.EXE C:\PROGRA~1\EGAMES~1\MAHJON~1\INSTALL.LOG
Mahjongg Tiles of Time-->C:\PROGRA~1\eGames\MAHJON~1\UNWISE.EXE C:\PROGRA~1\eGames\MAHJON~1\INSTALL.LOG
Menus intelligents (Windows Live Toolbar)-->MsiExec.exe /X{0CC70FEF-5068-4CD5-B4DE-86FFD98EC929}
Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office 2000 CD-ROM 2-->MsiExec.exe /I{0004040C-78E1-11D2-B60F-006097C998E7}
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
Microsoft Office Standard Edition 2003-->MsiExec.exe /I{9112040C-6000-11D3-8CFE-0150048383C9}
Microsoft Office XP Professional avec FrontPage-->MsiExec.exe /I{9028040C-6000-11D3-8CFE-0050048383C9}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Works-->MsiExec.exe /I{A059DE09-1B49-4450-B340-7AE097EC3F04}
mIRC-->C:\Program Files\mIRC\uninstall.exe _?=C:\Program Files\mIRC
Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 10 (KB911565)-->"C:\WINDOWS\$NtUninstallKB911565$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 10 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Step by Step Interactive Training (KB898458)-->"C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Step by Step Interactive Training (KB923723)-->"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950759)-->"C:\WINDOWS\$NtUninstallKB950759$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376)-->"C:\WINDOWS\$NtUninstallKB951376$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Mise à jour de sécurité pour Windows XP (KB960714)-->"C:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe"
Mise à jour pour Lecteur Windows Media 10 (KB913800)-->"C:\WINDOWS\$NtUninstallKB913800$\spuninst\spuninst.exe"
Mise à jour pour Lecteur Windows Media 10 (KB926251)-->"C:\WINDOWS\$NtUninstallKB926251$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Mises à jour HP (Supprimer uniquement)-->C:\WINDOWS\HPCPCUninstall-9972322\HPBWSetup.exe -appid 9972322 -uninstall
Monopoly-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D7E7EC5E-4349-4E40-B37C-4342188B86EC}\setup.exe" -l0x40c
MSN-->C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP
MSXML 4.0 SP2 (KB925672)-->MsiExec.exe /I{A9CF9052-F4A0-475D-A00F-A8388C62DD63}
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MUSICMATCH® Jukebox-->C:\PROGRA~1\MUSICM~1\MUSICM~1\unmatch.exe
muvee autoProducer 5.0-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{27428D1B-8CBA-4EEA-B9C0-A23CA7B4FCC1}\setup.exe" -l0x40c
muvee autoProducer unPlugged 2.0-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5FDD0538-C67A-4F67-B3F8-09D1AAF04D99}\setup.exe" -l0x40c
Navigation par onglets (Windows Live Toolbar)-->MsiExec.exe /X{E916E61F-DE9D-4EAF-91E1-CEB50016326A}
Nero 8-->MsiExec.exe /X{DFA4CA5A-D073-4964-B8F5-778612851036}
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NHL® 08-->MsiExec.exe /X{A7AA93B6-6909-4073-B4EC-45CCDEFD4665}
NVIDIA Drivers-->C:\WINDOWS\system32\nvunrm.exe UninstallGUI
Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
PC DUAL SHOCK-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0700\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{58A5D7ED-9B72-4D73-8A4A-37A0C8213350}\setup.exe" -l0x9
Pcsx2 0.9.4 Watermoose-->"C:\Program Files\Pcsx2_0.9.4\unins000.exe"
PDF Settings-->MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}
Petit Larousse 2007-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{1444B13F-B744-4624-9695-D9E6471817B1}\Setup.exe" -l0x40c
PowerISO-->"C:\Program Files\PowerISO\uninstall.exe"
Python 2.2 pywin32 extensions (build 203)-->"C:\Python22\Removepywin32.exe" -u "C:\Python22\pywin32-wininst.log"
Python 2.2.3-->C:\Python22\UNWISE.EXE C:\Python22\INSTALL.LOG
QuickTime-->C:\WINDOWS\unvise32qt.exe C:\WINDOWS\system32\QuickTime\Uninstall.log
Rayman Raving Rabbids-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{111E336D-30BF-4CD4-8D69-4541732AFB27}\setup.exe" -l0x40c -removeonly
RealArcade-->C:\Program Files\Real\RealArcade\Update\rnuninst.exe RealNetworks|RealArcade|1.2
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
SCRABBLE® Interactif EDITION 2007 Désinstaller-->C:\Program Files\UBISOFT\SCRABBLE® Interactif EDITION 2007\uninstall.exe
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
SILENT HILL 3-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{14D10AAC-9737-454E-A247-8075C26C30E1} /l1033
SILENT HILL 4-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{00BD992A-D4C7-447D-8AA1-60B5759EA30D}\setup.exe" -l0x9
Super Collapse! 3-->C:\PROGRA~1\GAMEHO~1\SUPERC~1\UNWISE.EXE /U C:\PROGRA~1\GAMEHO~1\SUPERC~1\INSTALL.LOG
SweetIM For Internet Explorer 3.0b-->MsiExec.exe /X{F6D63A65-BD23-46F3-B9A3-87F442423481}
Tap'Touche 5-->"C:\Program Files\Tap'Touche 5\désinstaller.exe"
Terayon DOCSIS Modem-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C98F2FE6-5AF5-11D6-8209-00D0B701C7B5}\Setup.exe" -l0x9
Tiger Woods PGA TOUR 07-->C:\Program Files\EA SPORTS\Tiger Woods PGA TOUR 07\EAUninstall.exe
Update for Windows XP (KB953356)-->"C:\WINDOWS\$NtUninstallKB953356$\spuninst\spuninst.exe"
USB 2.0 Camera-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D0AF1483-31AD-4FEB-A961-C9327185439F}\Setup.exe" -l0xc0c
VCRedistSetup-->MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
WALT DISNEY WORLD QUEST MAGICAL RACING TOUR-->C:\WINDOWS\IsUn040c.exe -fC:\FICHIE~1\DISNEY~1\DISNEY~1\DeIsL1.isu
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Mail-->MsiExec.exe /I{C514C594-23AA-4F13-A070-DB8BDB27594F}
Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
Windows Live Toolbar-->"C:\Program Files\Windows Live Toolbar\UnInstall.exe" {0A8C97AD-DEED-4894-B446-3ABA95A77D0D}
Windows Live Toolbar-->MsiExec.exe /X{0A8C97AD-DEED-4894-B446-3ABA95A77D0D}
Windows Live Writer-->MsiExec.exe /X{3DFF4274-EBB0-4356-9692-972965018954}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows XP Media Center Edition 2005 KB925766-->"C:\WINDOWS\$NtUninstallKB925766$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
WinZip-->"C:\Program Files\WinZip\WINZIP32.EXE" /uninstall

======Security center information======

AV: Avira AntiVir PersonalEdition Classic

System event log

Computer Name: KIM
Event Code: 26
Message: Application popup : Just-In-Time Debugging : An exception 'Runtime Error' has occurred in Script.

However, no debuggers are registered that can debug this exception. Unable to JIT debug.

Record Number: 43250
Source Name: Application Popup
Time Written: 20081224003030.000000-300
Event Type: information
User:

Computer Name: KIM
Event Code: 10010
Message: Le serveur {D40DAF26-8F39-4430-97B9-D3E1A42426C8} ne s'est pas enregistré sur DCOM avant la fin du temps imparti.

Record Number: 43249
Source Name: DCOM
Time Written: 20081224003030.000000-300
Event Type: error
User: KIM\HP_Administrateur

Computer Name: KIM
Event Code: 4226
Message: TCP/IP a atteint la limite de sécurité imposée sur le nombre de tentatives de connexion TCP simultanées.

Record Number: 43248
Source Name: Tcpip
Time Written: 20081224002318.000000-300
Event Type: warning
User:

Computer Name: KIM
Event Code: 7036
Message: Le service LiveUpdate est entré dans l'état : arrêté.

Record Number: 43247
Source Name: Service Control Manager
Time Written: 20081224002233.000000-300
Event Type: information
User:

Computer Name: KIM
Event Code: 7036
Message: Le service LiveUpdate est entré dans l'état : en cours d'exécution.

Record Number: 43246
Source Name: Service Control Manager
Time Written: 20081224002147.000000-300
Event Type: information
User:

Application event log

Computer Name: KIM
Event Code: 101
Message:
Record Number: 49391
Source Name: Automatic LiveUpdate Scheduler
Time Written: 20081223202703.000000-300
Event Type: information
User: AUTORITE NT\SYSTEM

Computer Name: KIM
Event Code: 101
Message:
Record Number: 49390
Source Name: Automatic LiveUpdate Scheduler
Time Written: 20081223202703.000000-300
Event Type: information
User: AUTORITE NT\SYSTEM

Computer Name: KIM
Event Code: 101
Message:
Record Number: 49389
Source Name: Automatic LiveUpdate Scheduler
Time Written: 20081223202529.000000-300
Event Type: information
User: AUTORITE NT\SYSTEM

Computer Name: KIM
Event Code: 101
Message:
Record Number: 49388
Source Name: Automatic LiveUpdate Scheduler
Time Written: 20081223202025.000000-300
Event Type: information
User: AUTORITE NT\SYSTEM

Computer Name: KIM
Event Code: 101
Message:
Record Number: 49387
Source Name: Automatic LiveUpdate Scheduler
Time Written: 20081223202025.000000-300
Event Type: information
User: AUTORITE NT\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;c:\Python22
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 43 Stepping 1, AuthenticAMD
"PROCESSOR_REVISION"=2b01
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

voici finalement le rapport info.txt....

je suis vraiment désolé du délai, j ai beaucoup de boulot ces temps-ci

merci beaucoup!

Logfile of random's system information tool 1.05 (written by random/random)
Run by HP_Administrateur at 2009-01-12 21:01:09
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 26 GB (11%) free of 229 GB
Total RAM: 958 MB (42% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:01:26, on 2009-01-12
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Laser Center\Laser Sensor Mouse\Panel.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Babylon\Babylon-Pro\Babylon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Larousse\Petit Larousse 2007\bin\Hyperappel.exe
C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HP\KBD\KBD.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Downloads\RSIT.exe
C:\Program Files\trend micro\HP_Administrateur.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?setlang=fr-CA&FORM=LTHP&mkt=en-ca&toHttps=1&redig=853483AAD1FC42F796D48640CF1A45F7
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?setlang=fr-CA&FORM=LTHP&mkt=en-ca&toHttps=1&redig=853483AAD1FC42F796D48640CF1A45F7
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.3.19.dll
O2 - BHO: (no name) - {3ABCEDAE-CD5D-41A5-BF51-40F4233B97BA} - C:\WINDOWS\system32\geBtQihG.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: iGamebar - {4E7BD74F-2B8D-469E-C0FF-FD69B994BD34} - C:\PROGRA~1\igamebar\igamebar.dll (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [Laser mouse] "C:\Program Files\Laser Center\Laser Sensor Mouse\Panel.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [STICAP] C:\WINDOWS\Twain_32\USB2.0Camera\SnapTrap.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Hyperappel du Petit Larousse 2007.lnk = C:\Program Files\Larousse\Petit Larousse 2007\bin\Hyperappel.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Mises à jour de HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-ca\msntabres.dll.mui/229?a5278b6c9d8b417b9717f6fb9930955a
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-ca\msntabres.dll.mui/230?a5278b6c9d8b417b9717f6fb9930955a
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - c:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/advanced/2.0.2.23/cfweb_activex.camfrogweb.com-advanced-2.0.2.23_instmodule.exe
O20 - Winlogon Notify: cbXRKBqq - cbXRKBqq.dll (file missing)
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O24 - Desktop Component 0: (no name) - http://www.ville.stfelicien.qc.ca/phototourisme/gif/hebbeaulieu.gif

[ Rapport ToolsCleaner version 2.3.0 (par A.Rothstein & dj QUIOU) ]

-->- Recherche:

C:\Combofix.txt: trouvé !
C:\*.msnfix: trouvé !
C:\UsbFix.txt: trouvé !
C:\MsnFix: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\SDFIX: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\hjt\HijackThis.exe: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\hjt\hijackthis.log: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\sdfix\SdFix.exe: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\sdfix\Msnfix.zip: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\sdfix\ComboFix.exe: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\sdfix\UsbFix.lnk: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\sdfix\OTMoveIt3.exe: trouvé !
C:\Documents and Settings\HP_Administrateur\Recent\MSNFix.lnk: trouvé !
C:\Documents and Settings\HP_Administrateur\Recent\HijackThis.lnk: trouvé !
C:\WINDOWS\msnfix.txt: trouvé !

---------------------------------
-->- Suppression:

C:\Documents and Settings\HP_Administrateur\Bureau\hjt\HijackThis.exe: supprimé !
C:\Documents and Settings\HP_Administrateur\Bureau\sdfix\SdFix.exe: supprimé !
C:\Documents and Settings\HP_Administrateur\Bureau\sdfix\Msnfix.zip: supprimé !
C:\Documents and Settings\HP_Administrateur\Bureau\sdfix\ComboFix.exe: supprimé !
C:\Documents and Settings\HP_Administrateur\Recent\MSNFix.lnk: supprimé !
C:\Documents and Settings\HP_Administrateur\Recent\HijackThis.lnk: supprimé !
C:\Combofix.txt: supprimé !
C:\*.msnfix: ERREUR DE SUPPRESSION !!
C:\UsbFix.txt: supprimé !
C:\Documents and Settings\HP_Administrateur\Bureau\hjt\hijackthis.log: supprimé !
C:\Documents and Settings\HP_Administrateur\Bureau\sdfix\UsbFix.lnk: supprimé !
C:\Documents and Settings\HP_Administrateur\Bureau\sdfix\OTMoveIt3.exe: supprimé !
C:\WINDOWS\msnfix.txt: supprimé !
C:\MsnFix: supprimé !
C:\Documents and Settings\HP_Administrateur\Bureau\SDFIX: supprimé !

Corbeille vidée!
Fichiers temporaires nettoyés !

voici le rapport toolscleaner

1/

---> Désinstalle UsbFix.

---> Menu Démarrer > Exécuter > Tape combofix /u et valide.

---> Télécharge ToolsCleaner2 sur ton Bureau.
* Double-clique sur ToolsCleaner2.exe pour le lancer.
* Clique sur Recherche et laisse le scan agir.
* Clique sur Suppression pour finaliser.
* Tu peux, si tu le souhaites, te servir des Options Facultatives.
* Clique sur Quitter pour obtenir le rapport.
* Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

2/

- Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

- Double-clique sur RSIT.exe afin de lancer le programme.

- Clique sur Continue à l'écran Disclaimer.

- Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

- Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

Note : Les rapports sont sauvegardés dans le dossier C:\rsit.

voici le rapport usbfix
désolé du délai.....

-------------- UsbFix V2.413.9 ---------------

* User : HP_Administrateur - KIM
* Outils mis a jours le 05/01/2009 par Chiquitine29 et Chimay8
* Recherche effectuée à 18:39:39 le 2009-01-06
* Windows Xp - Internet Explorer 6.0.2900.5512

--------------- [ Processus actifs ] ----------------

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avwsc.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE

--------------- [ Informations lecteurs ] ----------------

C: - Lecteur fixe

D: - Lecteur fixe

E: - Lecteur de CD-ROM

--------------- [ Lecteur C ] ----------------

C: - Lecteur fixe

+- Listing des fichiers présents :

[2006-08-24 21:46][--a------] C:\AUTOEXEC.BAT
[2004-08-09 16:00][-rahs----] C:\NTDETECT.COM
[2006-12-19 20:33][-rahs----] C:\boot.ini
[2008-12-31 19:18][--a------] C:\ComboFix.txt
[2008-12-31 19:18][--a------] C:\DBS.TXT
[2008-12-31 19:18][--a------] C:\DownloadLog.txt
[2008-12-31 19:18][--a------] C:\RecoveryCD.txt
[2008-12-31 19:18][--a------] C:\UsbFix.txt
[2005-10-18 12:41][--a------] C:\CONFIG.SYS
[2005-10-18 12:41][--a------] C:\hiberfil.sys
[2005-10-18 12:41][--a------] C:\IO.SYS
[2005-10-18 12:41][--a------] C:\MSDOS.SYS
[2005-10-18 12:41][--a------] C:\pagefile.sys

--------------- [ Lecteur D ] ----------------

D: - Lecteur fixe

+- Listing des fichiers présents :

[2001-07-28 04:07][---hs----] D:\AUTOEXEC.BAT
[2001-07-25 20:00][---hs----] D:\NTDETECT.COM
[2004-11-30 17:01][---hs----] D:\Info.exe
[2002-01-09 16:52][---hs----] D:\BOOT.INI
[2002-01-09 16:52][---hs----] D:\Desktop.ini
[2002-01-09 16:52][---hs----] D:\WINBOM.INI
[2002-09-10 15:21][---hs----] D:\Folder.htt
[2001-07-28 04:07][---hs----] D:\CONFIG.SYS
[2001-07-28 04:07][---hs----] D:\IO.SYS
[2001-07-28 04:07][---hs----] D:\MSDOS.SYS

--------------- [ Lecteur E ] ----------------

E: - Lecteur de CD-ROM

+- Listing des fichiers présents :

--------------- [ Registre / Startup ] ----------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="https://www.google.com/?gws_rd=ssl"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
MsnMsgr="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
DAEMON Tools="C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
swg=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
updateMgr="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
prunnet="C:\WINDOWS\system32\prunnet.exe"
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\AdobeUpdater=
<NO NAME>=

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
ehTray=C:\WINDOWS\ehome\ehtray.exe
ftutil2=rundll32.exe ftutil2.dll,SetWriteCacheMode
RTHDCPL=RTHDCPL.EXE
AlwaysReady Power Message APP=ARPWRMSG.EXE
NvCplDaemon=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz=nwiz.exe /install
HPHUPD08=c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
DMAScheduler="c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
Recguard=C:\WINDOWS\SMINST\RECGUARD.EXE
PCDrProfiler=
HPBootOp="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
HP Software Update=C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
Laser mouse="C:\Program Files\Laser Center\Laser Sensor Mouse\Panel.exe"
TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
STICAP=C:\WINDOWS\Twain_32\USB2.0Camera\SnapTrap.exe
SunJavaUpdateSched=C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
mmtask=c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
NeroFilterCheck=C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
NBKeyScan="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
Symantec PIF AlertEng="C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
Babylon Client=C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
UserFaultCheck=%systemroot%\system32\dumprep 0 -u
QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
prunnet="C:\WINDOWS\system32\prunnet.exe"
avgnt="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
Installed=1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
Installed=1
NoChange=1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
Installed=1

--------------- [ Registre / Mountpoint2 ] ----------------

-> Recherche négative.

--------------- [ Nettoyage des disques ] ----------------

Supprimé ! - [2002-09-10 15:21][---hs----] D:\Folder.htt
Supprimé ! - [2004-11-30 17:01][---hs----] D:\info.exe
Supprimé ! - [2004-04-29 21:37][---hs----] D:\THUMBS.DB

--------------- [ Resumé ] ----------------

-> /!\ Le resultat doit etre interprété par un spécialiste /!\

[2006-08-24 21:46][--a------] C:\AUTOEXEC.BAT
[2004-08-09 16:00][-rahs----] C:\NTDETECT.COM
[2006-12-19 20:33][-rahs----] C:\boot.ini
[2001-07-28 04:07][---hs----] D:\AUTOEXEC.BAT
[2001-07-25 20:00][---hs----] D:\NTDETECT.COM
[2002-01-09 16:52][---hs----] D:\BOOT.INI
[2002-01-09 16:52][---hs----] D:\Desktop.ini
[2002-01-09 16:52][---hs----] D:\WINBOM.INI

--------------- [ Vaccination ] ----------------

C:\autorun.inf -> Dossier autorun.inf crée par UsbFix !
D:\autorun.inf -> Dossier autorun.inf crée par UsbFix !

--------------- ! Fin du rapport ! ----------------

merci

---> Désinstalle AD-Remover.

--> Télécharge UsbFix (de Chiquitine29) sur ton Bureau.

--> Lance l'installation avec les paramètres par défaut.

--> Branche tes sources de données externes à ton PC (clé USB, disque dur externe, carte SD, etc...) sans les ouvrir.

--> Double-clique sur le raccourci UsbFix sur ton Bureau.

--> Choisis l'option 1 (Nettoyage).

--> Le PC va redémarrer.

--> Après redémarrage, poste le rapport UsbFix.txt

Note : le rapport UsbFix.txt est sauvegardé à la racine du disque.

(Si le Bureau ne réapparaît pas, presse Ctrl+Alt+Suppr, Onglet "Fichier", "Nouvelle tâche", tape explorer.exe et valide)

SALUT!

voici le rapport OTMoveit3

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
C:\Program Files\Macrogaming\SweetIM moved successfully.
C:\Program Files\Macrogaming moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\Historique\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\Cookies\index.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\hpodvd09.log scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\_hphtra07.log scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\~DF97EB.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\~DF97FF.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\~DFC36A.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 01022009_184236

Files moved on Reboot...
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\index.dat moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\Historique\History.IE5\index.dat moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\Cookies\index.dat moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\hpodvd09.log moved successfully.
DllUnregisterServer procedure not found in C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll NOT unregistered.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\IadHide5.dll moved successfully.
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\_hphtra07.log moved successfully.
File C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\~DF97EB.tmp not found!
File C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\~DF97FF.tmp not found!
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\~DFC36A.tmp moved successfully.
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat moved successfully.

Merci!!!

---> Désactive ton antivirus le temps de la manipulation car OTMoveIt3 est détecté comme une infection à tort.

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau :
http://oldtimer.geekstogo.com/OTMoveIt3.exe

---> Double-clique sur OTMoveIt3.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant ci-dessous :

:processes
explorer.exe

:files
C:\Program Files\Macrogaming

:commands
[purity]
[emptytemp]
[start explorer]
[reboot]

---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

voici le rapport ad remover....

--------- Logfile of AD-Remover 1.0.8.2 by C_XX ---------

*** Limited to ***

Boonty/BoontyGames
Eorezo
Everest Poker
Funwebproduct/MyWay/MyWebsearch
It's TV
Sweetim

******************

# START at: 15:33:07 | Jeu 2009-01-01 | Microsoft® Windows XP™ SP2 (v5.1.2600)
# BOOT MODE: Normal

# OPTION: Clean | EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat

# PC: KIM | USER: HP_Administrateur ( Current user is an administrator)

# DRIVE(S):
- C:\ (File System: NTFS)
- D:\ (File System: FAT32)
- E:\ (File System: UDF)

# Internet Explorer v6.0.2900.2180

--------- [ RUNNING PROCESSES: 60 ] ---------

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Laser Center\Laser Sensor Mouse\Panel.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Babylon\Babylon-Pro\Babylon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Larousse\Petit Larousse 2007\bin\Hyperappel.exe
C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
C:\WINDOWS\arservice.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
C:\WINDOWS\explorer.exe
C:\HP\KBD\KBD.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\BitComet\BitComet.exe
C:\WINDOWS\system32\ntvdm.exe

-----------------------------------

(!) ---- IE start pages reset

+-----------------------| Boonty/Boonty Games Elements Deleted :

"HKEY_CLASSES_ROOT\boontybox"
"HKEY_CURRENT_USER\SOFTWARE\Boonty"
"HKEY_LOCAL_MACHINE\Software\Boonty"
.
[2007-01-29 10:52] C:\Program Files\Boonty
[2006-08-28 18:36] C:\Program Files\Fichiers communs\BOONTY Shared
[2006-08-28 18:36] C:\Documents and Settings\All Users\Application Data\BOONTY

+-----------------------| Eorezo Elements Deleted :

.

+-----------------------| Everest Poker Elements Deleted :

.

+-----------------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements Deleted :

.

+-----------------------| It's TV Elements Deleted :

.

+-----------------------| Sweetim Elements Deleted :

"HKEY_CLASSES_ROOT\CLSID\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}"
"HKEY_CLASSES_ROOT\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}"
"HKEY_CLASSES_ROOT\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632"
"HKEY_CLASSES_ROOT\SWEETIE.IEToolbar"
"HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1"
"HKEY_CLASSES_ROOT\SWEETIE.SWEETIE"
"HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.1"
"HKEY_CLASSES_ROOT\ToolBand.SWEETIE"
"HKEY_CLASSES_ROOT\ToolBand.SWEETIE.1"
"HKEY_CLASSES_ROOT\Typelib\{58906392-79C4-497C-ACC6-6942B59F1A08}"
"HKEY_CLASSES_ROOT\MgMediaPlayer.GifAnimator"
"HKEY_CLASSES_ROOT\MgMediaPlayer.GifAnimator.1"
"HKEY_CURRENT_USER\SOFTWARE\SWEETIE"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run" /v "SweetIM"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Upgradecodes\A97CEC23332751B47BA4B95BAA50C9D0"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks" /v "{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1A0AADCD-3A72-4B5F-900F-E3BB5A838E2A}"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Macrogaming"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar" /v "{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run" /v "SweetIM"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{502358FB-0718-45BC-B142-7511F1694D58}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4318DF19719275242801CBE292063A4C"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\BF8532058170CB541B2457111F96D485"
.
/!\ NOT DELETED - [2008-02-13 21:34] C:\Program Files\Macrogaming
/!\ NOT DELETED - [2009-01-01 15:35] C:\Program Files\Macrogaming\SweetIM
/!\ NOT DELETED - [2006-07-11 18:35] C:\Program Files\Macrogaming\SweetIM\msvcr71.dll
[2008-08-29 23:25] C:\WINDOWS\Installer\{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}\ARPPRODUCTICON.exe
[2008-11-11 13:30] C:\WINDOWS\Installer\{3B26434C-FFA8-4A9C-A9C9-E8EE9C4E89D4}\ARPPRODUCTICON.exe
[2008-02-13 21:34] C:\WINDOWS\Installer\{502358FB-0718-45BC-B142-7511F1694D58}\ARPPRODUCTICON.exe
[2007-10-18 21:14] C:\WINDOWS\Installer\{DFA4CA5A-D073-4964-B8F5-778612851036}\ARPPRODUCTICON.exe

(!) ---- Temp files deleted.
(!) ---- Recycle bin emptied in all drives.

************* /!\ File(s)/Folder(s) Not Deleted /!\ *************

"C:\Program Files\Macrogaming\SweetIM"
"C:\Program Files\Macrogaming\SweetIM\msvcr71.dll"

Second run ...

RESIST ! - "C:\Program Files\Macrogaming\SweetIM"
RESIST ! - "C:\Program Files\Macrogaming\SweetIM\msvcr71.dll"

+-----------------------| ADDED SCAN :

+---------- Scanning prefs.js ... ( # Mozilla User Preferences )

...\iiuwlhea.default\prefs.js :

~~~~ Mozilla FireFox version [Unable to get version] ~~~~

+--+ +--+ +--+ +--+
.

+---------------------------------------------------------------------------+

+--[HKEY_CURRENT_USER\..\Run]

BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} REG_SZ "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
MsnMsgr REG_SZ "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe
DAEMON Tools REG_SZ "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
swg REG_SZ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
updateMgr REG_SZ "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
prunnet REG_SZ "C:\WINDOWS\system32\prunnet.exe"

+--[HKEY_LOCAL_MACHINE\..\Run]

ehTray REG_SZ C:\WINDOWS\ehome\ehtray.exe
ftutil2 REG_SZ rundll32.exe ftutil2.dll,SetWriteCacheMode
RTHDCPL REG_SZ RTHDCPL.EXE
AlwaysReady Power Message APP REG_SZ ARPWRMSG.EXE
NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz REG_SZ nwiz.exe /install
HPHUPD08 REG_SZ c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
DMAScheduler REG_SZ "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
Recguard REG_SZ C:\WINDOWS\SMINST\RECGUARD.EXE
PCDrProfiler REG_SZ
HPBootOp REG_SZ "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
HP Software Update REG_EXPAND_SZ C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
Laser mouse REG_SZ "C:\Program Files\Laser Center\Laser Sensor Mouse\Panel.exe"
TkBellExe REG_SZ "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
STICAP REG_SZ C:\WINDOWS\Twain_32\USB2.0Camera\SnapTrap.exe
SunJavaUpdateSched REG_SZ C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
mmtask REG_SZ c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
NeroFilterCheck REG_SZ C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
NBKeyScan REG_SZ "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
Symantec PIF AlertEng REG_SZ "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
Babylon Client REG_SZ C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
UserFaultCheck REG_EXPAND_SZ %systemroot%\system32\dumprep 0 -u
QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
prunnet REG_SZ "C:\WINDOWS\system32\prunnet.exe"
avgnt REG_SZ "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

+--[HKEY_USERS\.DEFAULT\..\Run]

+--[HKEY_CURRENT_USER\..\Internet Explorer\MAIN]

Start Page : hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

+--[HKEY_LOCAL_MACHINE\..\Internet Explorer\MAIN]

Start Page : hxxp://fr.msn.com/

+---------------------------------------------------------------------------+

- "C:\AD-report-Clean-20.9-.1-01.log" (~14396 bytes)

- "C:\AD-report-Scan-20.9-.1-01.log" (~35352 bytes)

# END at: 15:37:30 | 2009-01-01 - Time elapsed: 4 minutes, 23 seconds

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 218 lines ]
+---------------------------------------------------------------------------+

merci!

Bonne année ;)

/!\ Déconnecte-toi et ferme toutes applications en cours /!\

● Double-clique sur AD-Remover pour le lancer : au menu principal, choisis l'option B.

● Coche à l'écran de sélection :
http://sd-1.archive-host.com/membres/up/16506160323759868/Capturer-ADR.JPG

Suppression Boonty/BoontyGames (Si trouvé)
Suppression Eorezo (Si trouvé)
Suppression Everest Poker (Si trouvé)
Suppression Funwebproduct/MyWay/MyWebsearch (Si trouvé)
Suppression Messenger Skinner (Si trouvé)
Suppression Sweetim (Si trouvé)
Suppression It's TV (Si trouvé)

● Puis choisis S, le programme va travailler.

● Poste le rapport qui apparaît à la fin.

(Le rapport est sauvegardé aussi sous C:\Ad-report.log)

/!\ Si le Bureau ne réapparaît pas, presse Ctrl + Alt + Suppr, Onglet "Fichier", "Nouvelle tâche", tape explorer.exe et valide) /!\

bonnée année mesdames, messieurs voici le rapport adremover

--------- Logfile of AD-Remover 1.0.8.2 by C_XX ---------

# START at: 8:45:07 | Jeu 2009-01-01 | Microsoft® Windows XP™ SP2 (v5.1.2600)
# BOOT MODE: Normal

# OPTION: Scan | EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat

# PC: KIM | USER: HP_Administrateur ( Current user is an administrator)

# DRIVE(S):
- C:\ (File System: NTFS)
- D:\ (File System: FAT32)

# Internet Explorer v6.0.2900.2180

--------- [ RUNNING PROCESSES: 58 ] ---------

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Laser Center\Laser Sensor Mouse\Panel.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Babylon\Babylon-Pro\Babylon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Larousse\Petit Larousse 2007\bin\Hyperappel.exe
C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
C:\WINDOWS\arservice.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
C:\WINDOWS\explorer.exe
C:\HP\KBD\KBD.EXE
c:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\ntvdm.exe

-----------------------------------

+-----------------------| Boonty/Boonty Games Elements found :

"HKEY_CLASSES_ROOT\boontybox"
"HKEY_CURRENT_USER\SOFTWARE\Boonty"
"HKEY_LOCAL_MACHINE\Software\Boonty"
"HKEY_LOCAL_MACHINE\Software\Classes\boontybox"
.
[2007-01-29 10:52] C:\Program Files\Boonty
[2006-12-26 20:24] C:\Program Files\Boonty\Components
[2006-12-26 20:24] C:\Program Files\Boonty\Components\BoontyBox_01net_setup.exe
[2006-08-28 18:36] C:\Program Files\Fichiers communs\BOONTY Shared
[2006-08-28 18:36] C:\Program Files\Fichiers communs\BOONTY Shared\Service
[2006-08-28 18:36] C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
[2006-08-28 18:36] C:\Documents and Settings\All Users\Application Data\BOONTY
[2006-12-26 20:50] C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses
[2007-03-31 20:21] C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B41C7000.dat
[2007-03-31 20:11] C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B4410000.dat

+-----------------------| Eorezo Elements found :

.

+-----------------------| Everest Poker Elements found :

.

+-----------------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements found :

.

+-----------------------| It's TV Elements found :

.

+-----------------------| Sweetim Elements found :

"HKEY_CLASSES_ROOT\CLSID\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}"
"HKEY_CLASSES_ROOT\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}"
"HKEY_CLASSES_ROOT\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632"
"HKEY_CLASSES_ROOT\SWEETIE.IEToolbar"
"HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1"
"HKEY_CLASSES_ROOT\SWEETIE.SWEETIE"
"HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.1"
"HKEY_CLASSES_ROOT\ToolBand.SWEETIE"
"HKEY_CLASSES_ROOT\ToolBand.SWEETIE.1"
"HKEY_CLASSES_ROOT\Typelib\{58906392-79C4-497C-ACC6-6942B59F1A08}"
"HKEY_CLASSES_ROOT\MgMediaPlayer.GifAnimator"
"HKEY_CLASSES_ROOT\MgMediaPlayer.GifAnimator.1"
"HKEY_CURRENT_USER\SOFTWARE\SWEETIE"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run" /v "SweetIM"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Upgradecodes\A97CEC23332751B47BA4B95BAA50C9D0"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks" /v "{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1A0AADCD-3A72-4B5F-900F-E3BB5A838E2A}"
"HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Macrogaming"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar" /v "{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run" /v "SweetIM"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{502358FB-0718-45BC-B142-7511F1694D58}"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\789034A89BAC50E4782F0A7BDBF75632"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07D5290CDBDAE4242926B8E6CA650501"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08E33F7B61DEFF24BB9673ED7D467636"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E3D8A5B48622A445A7DF73FEFF32C3F"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1AC67655DD68F8240B2860F2D511EBD8"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4318DF19719275242801CBE292063A4C"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45FC115D1FEAEF849A4E1610D6EC8BF0"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\46A5861A389ADB844AF89E31BC9DF0A1"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49B0E1A6FF50BBE4289E4E23DE6EA0C7"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4CCCAC049F34D0540AAC13011398BEDB"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5C4389D0BFB302C479DE4178BD5D9EBA"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D19F074C042AD34BAB463D4175A062E"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D2B09BDEF4FE54418E6F3373CDBC7AC"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\61B65D3397A1FBF4CB1571B5E4F6B5B0"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E8A05C60DD9254591DBD16C94EDDBF"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\697E782CF574CC34CBB9566440BA12BC"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AE27A8613CF7EA4782F2886F67295E5"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CE172051F585E04187BCB97570BFA74"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86A901BA5265452499DCBF719C378EE3"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\88ABD1CD5C40EC84789A7F6EF86DAC5E"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A4B7EF3789F871419D9302583B20C15"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A6C53B0F76C44004A8F36716213017DB"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B59F2D8189784CC46A4597F2842480B0"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BD746FB95FB8E5B45BF66BE54D5FD91F"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCF399FCD6D2D3F46BF02A1378654FC9"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D149C1355C98DE24E82CEFBD996FE06A"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB8DAD19CFBCC2049A4477183787E8C5"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E337925F629CF4C4FB08F3D9674DD839"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F327D0C73C0973644A21E8CC852267A0"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9"
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\BF8532058170CB541B2457111F96D485"
.
[2008-02-13 21:34] C:\Program Files\Macrogaming
[2008-02-13 21:34] C:\Program Files\Macrogaming\SweetIM
[2008-02-13 21:34] C:\Program Files\Macrogaming\SweetIMBarForIE
[2008-02-13 21:34] C:\Program Files\Macrogaming\SweetIM\conf
[2008-02-13 21:34] C:\Program Files\Macrogaming\SweetIM\data
[2007-01-21 19:45] C:\Program Files\Macrogaming\SweetIM\default.xml
[2008-02-13 21:34] C:\Program Files\Macrogaming\SweetIM\logs
[2008-01-02 20:14] C:\Program Files\Macrogaming\SweetIM\mgAdaptersProxy.dll
[2008-01-02 20:15] C:\Program Files\Macrogaming\SweetIM\mgAIMAuto.dll
[2008-01-02 20:15] C:\Program Files\Macrogaming\SweetIM\mgAIMMessengerAdapter.dll
[2008-01-02 20:14] C:\Program Files\Macrogaming\SweetIM\mgArchive.dll
[2008-01-02 20:14] C:\Program Files\Macrogaming\SweetIM\mgcommon.dll
[2008-01-02 20:14] C:\Program Files\Macrogaming\SweetIM\mgcommunication.dll
[2008-01-02 20:14] C:\Program Files\Macrogaming\SweetIM\mgconfig.dll
[2008-01-02 20:14] C:\Program Files\Macrogaming\SweetIM\mgFlashPlayer.dll
[2008-01-02 20:14] C:\Program Files\Macrogaming\SweetIM\mghooking.dll
[2008-01-02 20:14] C:\Program Files\Macrogaming\SweetIM\mgIEPlayer.dll
[2008-01-02 20:14] C:\Program Files\Macrogaming\SweetIM\mglogger.dll
[2008-01-02 20:15] C:\Program Files\Macrogaming\SweetIM\mgMediaPlayer.dll
[2008-01-02 20:14] C:\Program Files\Macrogaming\SweetIM\mgMsnAuto.dll
[2008-01-02 20:15] C:\Program Files\Macrogaming\SweetIM\mgMsnMessengerAdapter.dll
[2008-01-02 20:15] C:\Program Files\Macrogaming\SweetIM\mgSweetIM.dll
[2008-01-02 20:15] C:\Program Files\Macrogaming\SweetIM\mgUpdateSupport.dll
[2008-01-02 20:15] C:\Program Files\Macrogaming\SweetIM\mgxml_wrapper.dll
[2008-01-02 20:15] C:\Program Files\Macrogaming\SweetIM\mgYahooAuto.dll
[2008-01-02 20:15] C:\Program Files\Macrogaming\SweetIM\mgYahooMessengerAdapter.dll
[2006-07-11 18:35] C:\Program Files\Macrogaming\SweetIM\msvcp71.dll
[2006-07-11 18:35] C:\Program Files\Macrogaming\SweetIM\msvcr71.dll
[2008-02-13 21:34] C:\Program Files\Macrogaming\SweetIM\resources
[2008-01-02 20:15] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
[2008-02-13 21:34] C:\Program Files\Macrogaming\SweetIM\update
[2007-01-21 19:45] C:\Program Files\Macrogaming\SweetIM\conf\adapter.xml
[2007-01-21 19:45] C:\Program Files\Macrogaming\SweetIM\conf\autoupdate.xml
[2007-12-23 13:45] C:\Program Files\Macrogaming\SweetIM\conf\logger.xml
[2007-01-21 19:45] C:\Program Files\Macrogaming\SweetIM\conf\messages.xml
[2007-07-25 15:57] C:\Program Files\Macrogaming\SweetIM\conf\sweetim.xml
[2007-01-21 19:45] C:\Program Files\Macrogaming\SweetIM\conf\sweetimapp.xml
[2008-04-29 15:44] C:\Program Files\Macrogaming\SweetIM\conf\users
[2008-02-24 17:01] C:\Program Files\Macrogaming\SweetIM\conf\users\bernatchez-kym@hotmail.com
[2008-04-29 15:44] C:\Program Files\Macrogaming\SweetIM\conf\users\cormier_lyne_@hotmail.com
[2008-02-21 18:12] C:\Program Files\Macrogaming\SweetIM\conf\users\jnot6@hotmail.com
[2007-01-21 19:45] C:\Program Files\Macrogaming\SweetIM\conf\users\main_user_config.xml
[2008-04-14 17:45] C:\Program Files\Macrogaming\SweetIM\conf\users\murray-1976@hotmail.com
[2008-02-25 08:08] C:\Program Files\Macrogaming\SweetIM\conf\users\bernatchez-kym@hotmail.com\emoticons_shortcut.xml
[2008-02-25 08:11] C:\Program Files\Macrogaming\SweetIM\conf\users\bernatchez-kym@hotmail.com\lastuse_Emoticons.xml
[2008-04-09 20:42] C:\Program Files\Macrogaming\SweetIM\conf\users\bernatchez-kym@hotmail.com\lastuse_Winks.xml
[2008-02-13 21:39] C:\Program Files\Macrogaming\SweetIM\conf\users\bernatchez-kym@hotmail.com\user_config.xml
[2008-04-29 15:44] C:\Program Files\Macrogaming\SweetIM\conf\users\cormier_lyne_@hotmail.com\emoticons_shortcut.xml
[2008-04-29 15:44] C:\Program Files\Macrogaming\SweetIM\conf\users\cormier_lyne_@hotmail.com\user_config.xml
[2008-02-21 18:12] C:\Program Files\Macrogaming\SweetIM\conf\users\jnot6@hotmail.com\emoticons_shortcut.xml
[2008-02-21 18:12] C:\Program Files\Macrogaming\SweetIM\conf\users\jnot6@hotmail.com\user_config.xml
[2008-04-14 17:45] C:\Program Files\Macrogaming\SweetIM\conf\users\murray-1976@hotmail.com\emoticons_shortcut.xml
[2008-04-14 17:45] C:\Program Files\Macrogaming\SweetIM\conf\users\murray-1976@hotmail.com\user_config.xml
[2008-07-04 18:54] C:\Program Files\Macrogaming\SweetIM\data\contentdb
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100AA.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100AB.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100AC.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100AD.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100AE.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100B3.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100B5.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100B6.dat
[2005-12-16 11:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100B7.dat
[2005-12-16 11:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100B9.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100BB.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100BD.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100CB.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100CC.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100CD.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100CE.dat
[2005-12-16 11:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100CF.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100D1.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100D5.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100D8.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100D9.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100DA.dat
[2005-12-16 11:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100DE.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100E5.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100E7.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100E8.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100FA.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100FD.dat
[2006-01-29 15:44] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010104.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010106.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010107.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010108.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001010C.dat
[2006-01-26 22:51] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010118.dat
[2006-01-19 18:33] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010119.dat
[2006-02-09 15:50] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001011E.dat
[2006-03-27 18:29] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010123.dat
[2006-03-27 18:29] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010124.dat
[2006-04-06 19:56] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010816.dat
[2006-04-06 20:56] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010817.dat
[2006-04-23 21:38] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010819.dat
[2006-04-23 21:38] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001081A.dat
[2006-04-23 21:38] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001081B.dat
[2006-05-23 19:52] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001081C.dat
[2006-06-07 23:36] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001083F.dat
[2006-06-07 23:36] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010841.dat
[2006-06-08 18:28] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010844.dat
[2006-06-08 00:02] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010845.dat
[2006-06-08 00:02] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010846.dat
[2006-06-08 00:02] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010847.dat
[2006-06-08 00:02] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001084A.dat
[2006-06-27 21:32] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001084B.dat
[2006-06-27 21:32] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001084C.dat
[2006-07-31 20:25] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001084D.dat
[2006-07-31 20:25] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001084F.dat
[2006-08-23 19:57] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010853.dat
[2006-08-23 19:57] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010854.dat
[2006-08-23 19:57] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010856.dat
[2006-08-23 19:57] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010859.dat
[2006-08-23 19:57] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001085E.dat
[2006-10-12 12:02] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010869.dat
[2006-10-12 12:02] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001086C.dat
[2006-11-01 15:01] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001086F.dat
[2006-11-15 13:13] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010871.dat
[2006-11-15 13:13] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010872.dat
[2007-01-10 11:27] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001088C.dat
[2007-03-01 16:52] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001088D.dat
[2007-03-01 16:52] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001088E.dat
[2007-03-01 16:52] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001088F.dat
[2007-03-01 16:52] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010890.dat
[2007-03-21 20:27] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010892.dat
[2007-03-21 20:27] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010893.dat
[2007-03-21 20:27] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010894.dat
[2007-04-11 18:21] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010895.dat
[2007-04-11 18:21] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010896.dat
[2007-04-11 18:21] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010897.dat
[2007-04-29 16:36] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010898.dat
[2007-05-13 21:13] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001089A.dat
[2007-05-13 21:13] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001089B.dat
[2007-05-13 21:13] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001089C.dat
[2007-05-13 21:13] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001089D.dat
[2007-05-27 10:47] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001089E.dat
[2007-05-27 18:09] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001089F.dat
[2007-06-10 12:07] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108A0.dat
[2007-06-10 12:07] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108A1.dat
[2007-06-27 13:08] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108A4.dat
[2007-06-27 13:08] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108A5.dat
[2007-06-27 13:08] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108A6.dat
[2007-07-15 11:46] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108A8.dat
[2007-08-13 22:21] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108A9.dat
[2007-09-17 12:06] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108AA.dat
[2007-09-17 12:06] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108AB.dat
[2007-10-09 11:41] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108AD.dat
[2007-10-22 10:33] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108AF.dat
[2007-10-23 12:37] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108B0.dat
[2007-11-05 19:41] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108B1.dat
[2007-11-05 19:41] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108B3.dat
[2007-11-05 19:41] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108B4.dat
[2007-11-05 18:41] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108B6.dat
[2007-11-05 19:41] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108B7.dat
[2007-11-20 18:52] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108B8.dat
[2007-11-21 11:02] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108B9.dat
[2007-12-02 12:30] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108BD.dat
[2007-12-02 13:30] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108BE.dat
[2007-12-16 10:54] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108C0.dat
[2007-12-16 10:54] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108C1.dat
[2007-12-16 10:54] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108C2.dat
[2007-12-16 09:54] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108C3.dat
[2007-12-16 10:54] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108C4.dat
[2007-12-30 12:14] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108C5.dat
[2008-01-13 19:33] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108CB.dat
[2008-01-13 20:33] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108CD.dat
[2008-01-28 20:00] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108CE.dat
[2008-02-04 20:48] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108CF.dat
[2008-02-17 12:49] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108D0.dat
[2008-02-17 12:49] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108D1.dat
[2008-02-17 12:49] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108D2.dat
[2008-02-29 11:03] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108D4.dat
[2008-02-29 11:03] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108D5.dat
[2008-03-13 16:25] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108DD.dat
[2008-03-27 17:11] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108E2.dat
[2008-03-30 17:43] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000108E5.dat
[2005-12-16 11:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002006B.dat
[2005-12-16 11:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002006E.dat
[2005-12-16 11:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020071.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020075.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020077.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020080.dat
[2006-01-19 17:33] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000200C0.dat
[2006-05-08 11:41] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000200D2.dat
[2006-07-31 20:25] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020112.dat
[2006-07-31 19:25] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020114.dat
[2007-01-10 11:27] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002013F.dat
[2007-03-01 15:52] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020148.dat
[2007-03-21 20:27] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020149.dat
[2007-05-13 20:13] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020158.dat
[2007-10-09 11:41] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020185.dat
[2007-10-21 19:48] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002018E.dat
[2007-11-05 20:01] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000201AD.dat
[2007-11-05 19:41] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000201AE.dat
[2007-12-16 10:53] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000201D5.dat
[2007-12-16 10:53] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000201E4.dat
[2007-12-16 09:53] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000201ED.dat
[2007-12-16 09:53] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000201F8.dat
[2008-01-28 20:00] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020241.dat
[2008-02-17 12:49] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020262.dat
[2008-02-17 12:49] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020265.dat
[2008-02-17 12:49] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020266.dat
[2007-11-05 19:41] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030063.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004001F.dat
[2005-12-16 12:23] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040024.dat
[2006-04-06 20:56] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040049.dat
[2007-01-10 11:27] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000400A3.dat
[2007-09-09 14:35] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00050004.dat
[2007-07-11 13:20] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00050005.dat
[2006-05-08 12:41] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0006003F.dat
[2006-08-24 12:30] C:\Program Files\Macrogaming\SweetIM\data\contentdb\0006006C.dat
[2007-04-29 16:36] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000600B1.dat
[2007-05-13 21:13] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000600B6.dat
[2008-01-28 20:00] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00060158.dat
[2008-04-24 17:18] C:\Program Files\Macrogaming\SweetIM\data\contentdb\000601A5.dat
[2008-04-24 17:18] C:\Program Files\Macrogaming\SweetIM\data\contentdb\00080014.dat
[2007-10-21 19:48] C:\Program Files\Macrogaming\SweetIM\data\contentdb\010108A7.dat
[2007-09-17 19:03] C:\Program Files\Macrogaming\SweetIM\data\contentdb\01050001.dat
[2007-07-11 13:19] C:\Program Files\Macrogaming\SweetIM\data\contentdb\01050002.dat
[2007-12-11 19:20] C:\Program Files\Macrogaming\SweetIM\data\contentdb\01050007.dat
[2008-07-04 18:54] C:\Program Files\Macrogaming\SweetIM\data\contentdb\cache_indx.dat
[2008-02-13 21:34] C:\Program Files\Macrogaming\SweetIM\resources\images
[2007-02-06 15:45] C:\Program Files\Macrogaming\SweetIM\resources\images\AudibleButton.png
[2007-02-06 15:46] C:\Program Files\Macrogaming\SweetIM\resources\images\DisplayPicturesButton.png
[2007-02-06 15:47] C:\Program Files\Macrogaming\SweetIM\resources\images\EmoticonButton.png
[2007-02-06 15:50] C:\Program Files\Macrogaming\SweetIM\resources\images\NudgeButton.png
[2007-02-06 15:43] C:\Program Files\Macrogaming\SweetIM\resources\images\SoundFxButton.png
[2007-02-06 15:27] C:\Program Files\Macrogaming\SweetIM\resources\images\WinksButton.png
[2006-07-02 17:58] C:\Program Files\Macrogaming\SweetIMBarForIE\affid.dat
[2006-10-12 16:50] C:\Program Files\Macrogaming\SweetIMBarForIE\basis.xml
[2006-07-02 17:58] C:\Program Files\Macrogaming\SweetIMBarForIE\Bookmarks_23x18.bmp
[2008-02-14 17:42] C:\Program Files\Macrogaming\SweetIMBarForIE\Cache
[2006-07-02 17:58] C:\Program Files\Macrogaming\SweetIMBarForIE\Email_23x18.bmp
[2006-07-02 17:58] C:\Program Files\Macrogaming\SweetIMBarForIE\Games_23x18.bmp
[2006-07-02 17:58] C:\Program Files\Macrogaming\SweetIMBarForIE\Greetingcards_23x18.bmp
[2006-07-02 17:58] C:\Program Files\Macrogaming\SweetIMBarForIE\Mobile_23x18.bmp
[2006-07-02 17:58] C:\Program Files\Macrogaming\SweetIMBarForIE\Music_23x18.bmp
[2006-07-02 17:58] C:\Program Files\Macrogaming\SweetIMBarForIE\News_23x18.bmp
[2006-07-02 17:58] C:\Program Files\Macrogaming\SweetIMBarForIE\Shoping_23x18.bmp
[2006-07-02 17:58] C:\Program Files\Macrogaming\SweetIMBarForIE\SmileySmile.bmp
[2006-07-02 17:58] C:\Program Files\Macrogaming\SweetIMBarForIE\SmileyWink.bmp
[2006-07-02 17:58] C:\Program Files\Macrogaming\SweetIMBarForIE\sweetimicons.bmp
[2006-11-05 16:46] C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.crc
[2006-11-05 16:44] C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
[2006-12-27 15:35] C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.xml
[2006-07-02 17:58] C:\Program Files\Macrogaming\SweetIMBarForIE\version.txt
[2008-03-22 07:29] C:\Program Files\Macrogaming\SweetIMBarForIE\Cache\cd2005c66fba47ff715ecc444d3bc1fb.xml
[2008-08-29 23:25] C:\WINDOWS\Installer\{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}\ARPPRODUCTICON.exe
[2008-11-11 13:30] C:\WINDOWS\Installer\{3B26434C-FFA8-4A9C-A9C9-E8EE9C4E89D4}\ARPPRODUCTICON.exe
[2008-02-13 21:34] C:\WINDOWS\Installer\{502358FB-0718-45BC-B142-7511F1694D58}\ARPPRODUCTICON.exe
[2007-10-18 21:14] C:\WINDOWS\Installer\{DFA4CA5A-D073-4964-B8F5-778612851036}\ARPPRODUCTICON.exe

+-----------------------| ADDED SCAN :

+---------- Scanning prefs.js ... ( # Mozilla User Preferences )

...\iiuwlhea.default\prefs.js :

~~~~ Mozilla FireFox version [Unable to get version] ~~~~

+--+ +--+ +--+ +--+
.

+---------------------------------------------------------------------------+

+--[HKEY_CURRENT_USER\..\Run]

BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} REG_SZ "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
MsnMsgr REG_SZ "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
ctfmon.exe REG_SZ C:\WINDOWS\system32\ctfmon.exe
DAEMON Tools REG_SZ "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
SweetIM REG_SZ C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
swg REG_SZ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
updateMgr REG_SZ "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
prunnet REG_SZ "C:\WINDOWS\system32\prunnet.exe"

+--[HKEY_LOCAL_MACHINE\..\Run]

ehTray REG_SZ C:\WINDOWS\ehome\ehtray.exe
ftutil2 REG_SZ rundll32.exe ftutil2.dll,SetWriteCacheMode
RTHDCPL REG_SZ RTHDCPL.EXE
AlwaysReady Power Message APP REG_SZ ARPWRMSG.EXE
NvCplDaemon REG_SZ RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
nwiz REG_SZ nwiz.exe /install
HPHUPD08 REG_SZ c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
DMAScheduler REG_SZ "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
Recguard REG_SZ C:\WINDOWS\SMINST\RECGUARD.EXE
PCDrProfiler REG_SZ
HPBootOp REG_SZ "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
HP Software Update REG_EXPAND_SZ C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
Laser mouse REG_SZ "C:\Program Files\Laser Center\Laser Sensor Mouse\Panel.exe"
TkBellExe REG_SZ "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
STICAP REG_SZ C:\WINDOWS\Twain_32\USB2.0Camera\SnapTrap.exe
SunJavaUpdateSched REG_SZ C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
mmtask REG_SZ c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
NeroFilterCheck REG_SZ C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
NBKeyScan REG_SZ "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
SweetIM REG_SZ C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
Symantec PIF AlertEng REG_SZ "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
Babylon Client REG_SZ C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
UserFaultCheck REG_EXPAND_SZ %systemroot%\system32\dumprep 0 -u
QuickTime Task REG_SZ "C:\Program Files\QuickTime\qttask.exe" -atboottime
prunnet REG_SZ "C:\WINDOWS\system32\prunnet.exe"
avgnt REG_SZ "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

+--[HKEY_USERS\.DEFAULT\..\Run]

+--[HKEY_CURRENT_USER\..\Internet Explorer\MAIN]

Start Page : hxxp://sympatico.msn.ca/defaultf.aspx

+--[HKEY_LOCAL_MACHINE\..\Internet Explorer\MAIN]

Start Page : hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_CA&c=63&bd=PAVILION&pf=desktop

+---------------------------------------------------------------------------+

- "C:\AD-report-Scan-20.9-.1-01.log" (~35016 bytes)

# END at: 8:45:23 | 2009-01-01 - Time elapsed: 16.0 seconds

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 452 lines ]
+---------------------------------------------------------------------------+

merci......

● Télécharge AD-Remover (de Cyrildu17 / C_XX) sur ton Bureau.

/!\ Déconnecte-toi et ferme toutes applications en cours /!\

● Double-clique sur le programme d'installation, installe-le dans son emplacement par défaut (C:\Program files).
● Double-clique sur l'icône Ad-remover située sur ton Bureau.
● Au menu principal, choisis l'option "A".
● Poste le rapport qui apparaît à la fin.

(Le rapport est sauvegardé aussi sous C:\Ad-report(date).log)

(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

Note :

"Process.exe", une composante de l'outil, est détectée par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

alors.... voici le rapport combofix tel que demandé;

ComboFix 08-12-28.04 - HP_Administrateur 2008-12-31 19:07:42.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.958.489 [GMT -5:00]
Lancé depuis: c:\documents and settings\HP_Administrateur\Bureau\ske.exe
Commutateurs utilisés :: c:\documents and settings\HP_Administrateur\Bureau\CFScript.txt
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\HP_Administrateur\Application Data\Twain
c:\program files\Webtools
c:\windows\system32\drivers\TDSSmxoe.sys
c:\windows\system32\TDSSirxy.dll
c:\windows\system32\TDSSktpa.dll
c:\windows\system32\TDSSncun.dll
c:\windows\system32\TDSSofxh.log
c:\windows\system32\TDSSqqcn.dll
c:\windows\system32\TDSSwupe.dat
c:\windows\system32\TDSSyavu.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-12-01 au 2009-01-01 ))))))))))))))))))))))))))))))))))))
.

2008-12-23 18:33 . 2008-12-23 18:33 <REP> d-------- c:\program files\Avira
2008-12-23 18:33 . 2008-12-23 18:33 <REP> d-------- c:\documents and settings\All Users\Application Data\Avira
2008-12-11 20:18 . 2008-12-11 20:18 <REP> d-------- c:\program files\KONAMI
2008-12-11 03:27 . 2008-12-11 03:27 244 --ah----- C:\sqmnoopt07.sqm
2008-12-11 03:27 . 2008-12-11 03:27 232 --ah----- C:\sqmdata07.sqm

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-01 00:11 --------- d-----w c:\documents and settings\All Users\Application Data\Babylon
2008-12-31 00:01 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2008-12-30 12:16 --------- d-----w c:\documents and settings\HP_Administrateur\Application Data\LimeWire
2008-12-30 03:09 --------- d-----w c:\documents and settings\HP_Administrateur\Application Data\Babylon
2008-12-27 12:31 --------- d-----w c:\program files\Conduit
2008-12-26 16:10 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-26 16:06 --------- d-----w c:\program files\EA SPORTS
2008-12-26 16:02 --------- d-----w c:\program files\Ma Pension d'animaux 2
2008-12-26 16:00 --------- d-----w c:\program files\Atari
2008-12-26 15:50 --------- d-----w c:\program files\Zylom Games
2008-12-24 12:22 --------- d-----w c:\program files\Symantec
2008-12-24 12:22 --------- d-----w c:\program files\Norton AntiVirus
2008-12-24 12:22 --------- d-----w c:\program files\Fichiers communs\Symantec Shared
2008-12-24 12:22 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2008-12-21 01:43 --------- d-----w c:\program files\BitComet
2008-11-18 01:54 --------- d-----w c:\program files\Barbie®
2008-11-13 01:34 --------- d-----w c:\program files\QuickTime
2008-11-11 22:12 --------- d-----w c:\program files\Fichiers communs\Barbie
2008-11-11 18:29 --------- d-----w c:\program files\THQ
2008-11-11 14:24 --------- d-----w c:\program files\Infogrames
2008-11-11 00:47 --------- d-----w c:\program files\Eidos Interactive
2008-11-10 01:32 --------- d-----w c:\documents and settings\HP_Administrateur\Application Data\BarbieIP
2008-11-10 00:44 --------- d-----w c:\program files\Activision
2008-01-20 19:02 24,192 ----a-w c:\documents and settings\HP_Administrateur\usbsermptxp.sys
2008-01-20 19:02 22,768 ----a-w c:\documents and settings\HP_Administrateur\usbsermpt.sys
2006-10-12 20:31 85,072 -c--a-w c:\documents and settings\HP_Administrateur\Application Data\GDIPFONTCACHEV1.DAT
2006-09-24 11:10 768,767,664 ----a-w c:\program files\nero72pr.bin
2006-09-24 11:09 74 ----a-w c:\program files\nero72pr.cue
2006-09-05 16:03 774,144 ----a-w c:\program files\RngInterstitial.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3ABCEDAE-CD5D-41A5-BF51-40F4233B97BA}]
c:\windows\system32\geBtQihG.dll [BU]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [BU]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-11-12 157592]
"SweetIM"="c:\program files\Macrogaming\SweetIM\SweetIM.exe" [2008-01-02 103712]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-08 68856]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"prunnet"="c:\windows\system32\prunnet.exe" [BU]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-01-24 7311360]
"HPHUPD08"="c:\program files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 49152]
"DMAScheduler"="c:\program files\HP DigitalMedia Archive\DMAScheduler.exe" [2006-03-20 90112]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2005-07-22 237568]
"HPBootOp"="c:\program files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 249856]
"HP Software Update"="c:\program files\HP\HP Software Update\HPwuSchd2.exe" [2005-12-15 49152]
"Laser mouse"="c:\program files\Laser Center\Laser Sensor Mouse\Panel.exe" [2005-06-20 233472]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [BU]
"STICAP"="c:\windows\Twain_32\USB2.0Camera\SnapTrap.exe" [2004-11-05 155648]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 49263]
"mmtask"="c:\program files\MusicMatch\MusicMatch Jukebox\mmtask.exe" [2004-01-26 53248]
"NeroFilterCheck"="c:\program files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 1836328]
"SweetIM"="c:\program files\Macrogaming\SweetIM\SweetIM.exe" [2008-01-02 103712]
"Symantec PIF AlertEng"="c:\program files\Fichiers communs\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"Babylon Client"="c:\program files\Babylon\Babylon-Pro\Babylon.exe" [2008-03-11 3551456]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-12 98304]
"prunnet"="c:\windows\system32\prunnet.exe" [BU]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"ftutil2"="ftutil2.dll" [2004-06-07 c:\windows\system32\ftutil2.dll]
"RTHDCPL"="RTHDCPL.EXE" [2006-03-08 c:\windows\RTHDCPL.EXE]
"AlwaysReady Power Message APP"="ARPWRMSG.EXE" [2005-08-02 c:\windows\arpwrmsg.exe]
"nwiz"="nwiz.exe" [2006-01-24 c:\windows\system32\nwiz.exe]
"PCDrProfiler"="" [BU]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 282624]
Hyperappel du Petit Larousse 2007.lnk - c:\program files\Larousse\Petit Larousse 2007\bin\Hyperappel.exe [2007-03-04 237568]
Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
Mises … jour de HP.lnk - c:\program files\Updates from HP\9972322\Program\Updates from HP.exe [2006-08-24 36903]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2006-10-31 122880]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbXRKBqq]
cbXRKBqq.dll [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
--a------ 2004-01-26 10:46 53248 c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
--a------ 2004-01-26 10:46 118784 c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Documents and Settings\\HP_Administrateur\\Bureau\\jeux\\Rescousse_de_la_Grubule.exe"=
"c:\\Program Files\\E Games\\Mahjongg Master Egyptian Edition\\MJMEgypt.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"4662:TCP"= 4662:TCP:emule
"4672:UDP"= 4672:UDP:emule
"21974:TCP"= 21974:TCP:BitComet 21974 TCP
"21974:UDP"= 21974:UDP:BitComet 21974 UDP

R3 GMFilter Filter;GMFilter Filter;c:\windows\system32\Drivers\GMFilter.sys [2006-08-26 25088]
R3 SQTECH930B;USB 2.0 PC CAMERA;c:\windows\system32\Drivers\Capt930b.sys [2006-09-03 247325]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480
.
- - - - ORPHELINS SUPPRIMES - - - -

WebBrowser-{6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - (no file)

.
------- Examen supplémentaire -------
.
uStart Page = hxxp://sympatico.msn.ca/defaultf.aspx
uSearch Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_CA&c=63&bd=PAVILION&pf=desktop
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=FR_CA&c=63&bd=PAVILION&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_CA&c=63&bd=PAVILION&pf=desktop
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Download all links using BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Download all videos using BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: Download link using &BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
IE: Easy-WebPrint Ajouter à la liste d'impressions - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Ouvrir dans un nouvel onglet d'arrière-plan - c:\program files\Windows Live Toolbar\Components\fr-ca\msntabres.dll.mui/229?a5278b6c9d8b417b9717f6fb9930955a
IE: Ouvrir dans un nouvel onglet de premier plan - c:\program files\Windows Live Toolbar\Components\fr-ca\msntabres.dll.mui/230?a5278b6c9d8b417b9717f6fb9930955a
IE: Translate with &Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm

c:\windows\Downloaded Program Files\InstallerControl.dll - O16 -: CabBuilder
hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
c:\windows\Downloaded Program Files\OSDED4D.OSD
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-31 19:12:01
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\windows\arservice.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Fichiers communs\LightScribe\LSSrvc.exe
c:\program files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\nvsvc32.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\dllhost.exe
c:\windows\ehome\ehmsas.exe
c:\windows\system32\wscntfy.exe
c:\program files\Windows Live\Messenger\usnsvc.exe
c:\program files\Java\jre1.5.0_09\bin\jucheck.exe
.
**************************************************************************
.
Heure de fin: 2008-12-31 19:18:25 - La machine a redémarré [HP_Administrateur]
ComboFix-quarantined-files.txt 2009-01-01 00:18:22
ComboFix2.txt 2008-12-30 02:59:02

Avant-CF: 30,723,076,096 octets libres
Après-CF: 31,045,484,544 octets libres

229 --- E O F --- 2008-12-18 08:01:17

j ai du reprendre celui-ci 2 fois car lors du redémarrage de mon pc, un programme a interrompu le processus et je n ai pu avoir acces au rapport.

j attends de vos nouvellles, bonne année 2009

Salut,

/!\ Seul murraysintrouble peut suivre cette procédure /!\

1/

---> Ouvre le Bloc-notes.

---> Copie le texte ci-dessous par sélection puis Ctrl+C :

KillAll::

Rootkit::
c:\windows\system32\drivers\TDSSmxoe.sys

Folder::
c:\documents and settings\HP_Administrateur\Application Data\Twain
c:\program files\Webtools

Registry::
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\TDSSserv.sys]

---> Colle la sélection dans le bloc-notes

---> Enregistre ce fichier sur le bureau (Impératif)

---> Nom du fichier : CFScript
---> Type du fichier : tous les fichiers
---> Clique sur Enregistrer
---> Quitte le bloc-notes

2/

---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

[*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

[*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.

[*] Une fois le scan achevé, un rapport va s'afficher : poste-le

[*] Si le fichier ne s'ouvre pas, il se trouve ici C:\Combofix.txt