Win 32 magania

monstre -

Bonjour,
j'ai une version d'aisser de kaspersky 2009 et n'arrive pas a enlever le virus win32 magania et trojan-game thiel
merci pour votre aide

Configuration: Windows XP
Firefox 3.0.1

Afficher la suite

A voir également

Win 32 magania
Cle win 8.1 - Guide
Power iso 32 bit - Télécharger - Gravure
32 bits - Guide
Win rar - Télécharger - Compression & Décompression
Win zip - Télécharger - Compression & Décompression

10 réponses

Résumé de la discussion

Un utilisateur cherche à enlever le virus Win32 Magania et le Trojan-Game Thiel sur Windows XP malgré Kaspersky Internet Security 2009 et cherche ensuite une méthode efficace de désinfection. Plusieurs utilisateurs proposent des outils et procédures de décontamination, notamment OTMoveIt3, RSIT et HijackThis, ainsi que l'utilisation d'alternatives antivirus gratuites et de méthodes pas à pas. Des conseils pratiques incluent la suppression des cracks et keygens pour éviter réinfections et l'analyse des rapports générés par ces outils, puis d'attendre le retour du système une fois la désinfection confirmée. Enfin, la discussion met en évidence que des rapports d'outils tels que RSIT ou OTMoveIt3 permettent d'identifier les éléments à supprimer et de vérifier l'état du système après désinfection.

Réponse 1 / 10 - Meilleure réponse
La meilleure réponse est la réponse qui a été validée par nos équipes.
anthony5151 Contributeur sécurité
Avec autant de cracks et keygens, pas étonnant que ton ordinateur soit infecté ! En plus d'être illégaux, les cracks sont l'un des principaux vecteurs d'infections aujourd'hui... Plus d'infos ici
Il faut les bannir complément... Si tu ne les supprimes pas, inutile de continuer la désinfection, les cracks et keygens réinfecteront ton ordinateur sans arrêt !

C'est d'autant plus idiot qu'il existe des antivirus gratuits efficaces que tu pourrais utiliser au lieu de pirater Kaspersky (AntiVir), qu'il existe des alternatives gratuites à WinZip (exemple : 7zip)...

Pour les supprimer :

• Télécharge OTMoveIt3 (de OldTimer) sur ton Bureau
• Double-clique sur OTMoveIt3.exe afin de le lancer.
• Clique sur ce lien et copie le script qu'il contient
• Colle le script dans le cadre « Paste Instructions for Items to be Moved » et clique sur Moveit.
• Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. Accepte en cliquant sur YES.
• Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles
Le nom du rapport correspond au moment de sa création : date_heure.log

(si j'en ai oublié, supprime les autres stp)

3

Réagir
1. monstre
  
  le lien OTMoveIt3 ne fonctionne pas 404 not found
  
  0
  
  Réagir
Réponse 2 / 10
anthony5151 Contributeur sécurité
Vu le nombre important d'antivirus qui le détectent, il semble effectivement que ce programme soit néfaste...

0

Réagir
Réponse 3 / 10
anthony5151 Contributeur sécurité
• Télécharge RHosts (de S!Ri)
• Double clique dessus pour l'exécuter
• Clique sur "Restore original Hosts" (il ne se passe rien de visible, c'est normal)
• Pour finir, fais redémarrer l'ordinateur.

Ensuite :

/!\ A l'attention de ceux qui passent sur ce sujet /!\
Le logiciel qui suit n'est pas à utiliser à la légère et peut faire des dégâts s'il est mal utilisé ! Ne le faites que si un helpeur du forum qui connait bien cet outil vous l'a recommandé.

/!\ Désactive tous tes logiciels de protection /!\

• Télécharge ComboFix (de sUBs) sur ton Bureau.
• Double-clique sur ComboFix.exe afin de le lancer.
• Il va te demander d'installer la console de récupération : accepte.
• Ne touche à rien pendant le scan.
• Lorsque la recherche sera terminée, un rapport apparaîtra. Poste ce rapport (C:\Combofix.txt) dans ta prochaine réponse.

Tutoriel officiel de Combofix : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

0

Réagir
1. monstre
 
 salut
 j'ai un logiciel qui j'étulise pour ouvrir youtube car youtube est bloquer dans notre serveur le logiciel est u89resv1 est t'il qui cause ce probleb de redirection du serveur, es que je le désinstalle
 MERCI
 
 0
 
 Réagir
2. anthony5151 Contributeur sécurité
 
 @monstreJe ne connais pas ce programme. Où l'as-tu eu ?
 
 0
 
 Réagir
3. monstre
 
 @anthony5151j'ai ce programme a travers un amis qui ma donnez le nom du programme et je le télécharger a travers google, le lien de téléchargement j'ai loublier, stp es qu'il est malveillant ou non?
 
 0
 
 Réagir
4. anthony5151 Contributeur sécurité
 
 @monstreJe ne sais pas...
 
 S'il n'est pas trop gros, tu peux l'analyser sur ce site
 
 0
 
 Réagir
5. monstre
 
 @anthony5151salut j'ai l'analysé il ma donnez le résultat suivante :
 Fichier u89.exe reçu le 2009.06.14 14:56:42 (UTC)
 Antivirus Version Dernière mise à jour Résultat
 a-squared 4.5.0.18 2009.06.14 Virus.Win32.VB!IK
 AhnLab-V3 5.0.0.2 2009.06.14 -
 AntiVir 7.9.0.187 2009.06.14 TR/Crypt.FKM.Gen
 Antiy-AVL 2.0.3.1 2009.06.12 -
 Authentium 5.1.2.4 2009.06.13 W32/VB-Backdoor-TWNF-based!Maximus
 Avast 4.8.1335.0 2009.06.13 Win32:Trojan-gen {Other}
 AVG 8.5.0.339 2009.06.14 -
 BitDefender 7.2 2009.06.14 -
 CAT-QuickHeal 10.00 2009.06.13 -
 ClamAV 0.94.1 2009.06.14 -
 Comodo 1327 2009.06.14 -
 DrWeb 5.0.0.12182 2009.06.14 -
 eSafe 7.0.17.0 2009.06.11 Suspicious File
 eTrust-Vet 31.6.6556 2009.06.12 -
 F-Prot 4.4.4.56 2009.06.13 W32/VB-Backdoor-TWNF-based!Maximus
 F-Secure 8.0.14470.0 2009.06.13 -
 Fortinet 3.117.0.0 2009.06.14 -
 GData 19 2009.06.14 Win32:Trojan-gen {Other}
 Ikarus T3.1.1.59.0 2009.06.14 Virus.Win32.VB
 K7AntiVirus 7.10.762 2009.06.12 -
 Kaspersky 7.0.0.125 2009.06.14 -
 McAfee 5645 2009.06.13 Generic.dx
 McAfee+Artemis 5645 2009.06.13 Generic.dx
 Microsoft 1.4701 2009.06.14 -
 NOD32 4153 2009.06.14 probably a variant of Win32/Agent
 Norman 6.01.09 2009.06.12 -
 nProtect 2009.1.8.0 2009.06.14 -
 Panda 10.0.0.14 2009.06.14 -
 PCTools 4.4.2.0 2009.06.12 -
 Prevx 3.0 2009.06.14 -
 Rising 21.33.62.00 2009.06.14 -
 Sophos 4.42.0 2009.06.14 Mal/VB-G
 Sunbelt 3.2.1858.2 2009.06.13 -
 Symantec 1.4.4.12 2009.06.14 -
 TheHacker 6.3.4.3.345 2009.06.13 -
 TrendMicro 8.950.0.1092 2009.06.12 PAK_Generic.001
 VBA32 3.12.10.7 2009.06.14 -
 ViRobot 2009.6.13.1785 2009.06.13 -
 VirusBuster 4.6.5.0 2009.06.14 -
 Information additionnelle
 File size: 503808 bytes
 MD5...: bc23cb2d1b1ea9fbc6616dcbb32c1457
 SHA1..: dfce3397a2d8493605daac96e8e4c357b6c1bb27
 SHA256: 21d3e9f1a2ede447ad2e38097133e174760f0111e6be31ff99c58a3483c8663e
 ssdeep: - 
 PEiD..: -
 TrID..: File type identification DirectShow filter (36.0%) Win32 Executable Microsoft Visual Basic 6 (22.5%) Windows OCX File (22.1%) Win32 Executable MS Visual C++ (generic) (6.7%) UPX compressed Win32 Executable (5.4%)
 PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x1590 timedatestamp.....: 0x49725b59 (Sat Jan 17 22:27:37 2009) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0xaa24 0xb000 5.20 1e6775c623e78ab6dc9ac6d514e3cd3f .data 0xc000 0xa54 0x1000 0.00 620f0b67a91f7f74151bc5be745b7110 .rsrc 0xd000 0x6d3b4 0x6e000 6.96 ac8b7e8034b6687043d381e8d07c7f8b ( 1 imports ) > MSVBVM60.DLL: _CIcos, _adj_fptan, __vbaVarMove, __vbaStrI4, __vbaFreeVar, __vbaAryMove, __vbaFreeVarList, __vbaEnd, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaStrCat, __vbaSetSystemError, __vbaHresultCheckObj, __vbaNameFile, _adj_fdiv_m32, __vbaAryDestruct, __vbaVarForInit, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, _adj_fdivr_m16i, _CIsin, -, __vbaChkstk, __vbaFileClose, EVENT_SINK_AddRef, -, __vbaPutOwner3, DllFunctionCall, _adj_fpatan, EVENT_SINK_Release, -, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, __vbaStrToUnicode, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, __vbaVarCat, __vbaI2Var, _CIlog, __vbaErrorOverflow, __vbaFileOpen, __vbaNew2, __vbaVar2Vec, __vbaR8Str, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, -, __vbaStrToAnsi, __vbaVarDup, -, _CIatan, __vbaStrMove, __vbaStrVarCopy, _allmul, _CItan, __vbaVarForNext, _CIexp, __vbaFreeObj, __vbaFreeStr, - ( 0 exports ) 
 PDFiD.: -
 RDS...: NSRL Reference Data Set -
 
 0
 
 Réagir
Réponse 4 / 10
anthony5151 Contributeur sécurité
Il manque encore la partie hijackthis du rapport :(

Est-ce que tu peux essayer de lancer hijackthis seul, choisir "do a system scan and save a logfile" et poster le rapport stp ?

0

Réagir
1. monstre
  
  voila le rapport hijack
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 02:54, on 10/06/2009
  Platform: Windows XP SP3 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\acs.exe
  C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
  C:\WINDOWS\system32\AstSrv.exe
  C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
  C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe
  C:\Program Files\Google\Update\GoogleUpdate.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
  C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
  C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\ltmoh\Ltmoh.exe
  C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\WINDOWS\AGRSMMSG.exe
  C:\Program Files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe
  C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\WINDOWS\system32\wscntfy.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\Program Files\JLC's Software\Internet TV\Internet TV.exe
  C:\Program Files\Real\RealPlayer\RecordingManager.exe
  C:\Documents and Settings\toshiba\Bureau\HiJackThis.exe
  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&gc=1&q=
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
  R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&gc=1&q=
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&gc=1&q=%s
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
  R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Program Files\AskSearch\bin\DefaultSearch.dll
  O1 - Hosts: 66.98.148.65 auto.search.msn.com
  O1 - Hosts: 66.98.148.65 auto.search.msn.es
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
  O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
  O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
  O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
  O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
  O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
  O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
  O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
  O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
  O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [HPUsageTracking] "C:\Program Files\HP\HP UT\bin\hppusg.exe" "C:\Program Files\HP\HP UT"
  O4 - HKLM\..\Run: [PrnStatusMX] C:\Program Files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
  O4 - HKLM\..\Run: [jdbtray] C:\WINDOWS\jdbcconf.exe
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
  O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
  O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
  O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
  O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
  O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
  O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
  O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
  O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
  O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
  O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?8d90ad08d8d74b998c8c8ffacb1213a6
  O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?8d90ad08d8d74b998c8c8ffacb1213a6
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
  O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
  O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
  O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
  O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
  O20 - AppInit_DLLs: acaptuser32.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
  O23 - Service: Service de configuration Atheros (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: AST Service (astcc) - Advanced Software Technologies - C:\WINDOWS\system32\AstSrv.exe
  O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
  O23 - Service: BCL easyPDF SDK 5 Loader (bepldr) - Unknown owner - C:\Program Files\Fichiers communs\BCL Technologies\easyPDF 5\bepldr.exe
  O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
  O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - Firebird Project - C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe
  O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - Firebird Project - C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe
  O23 - Service: Service Google Update (gupdate1c9d80fecd7376a) (gupdate1c9d80fecd7376a) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
  O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
  O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
  O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)
  
  0
  
  Réagir
Vous n’avez pas trouvé la réponse que vous recherchez ?

La communauté CCM répond en moyenne en moins de 2h.

Posez votre question
Réponse 5 / 10
anthony5151 Contributeur sécurité
Télécharge et installe hijackthis.
Il va se lancer automatiquement : referme le.

Puis poste un nouveau rapport RSIT stp

0

Réagir
1. monstre
  
  voila le rapport RSIT
  Logfile of random's system information tool 1.06 (written by random/random)
  Run by toshiba at 2009-06-09 22:31:48
  Microsoft Windows XP Édition familiale Service Pack 3
  System drive C: has 18 GB (24%) free of 76 GB
  Total RAM: 446 MB (5% free)
  
  ======Scheduled tasks folder======
  
  C:\WINDOWS\tasks\1-Click Maintenance.job
  C:\WINDOWS\tasks\AppleSoftwareUpdate.job
  C:\WINDOWS\tasks\Google Software Updater.job
  C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job
  C:\WINDOWS\tasks\Vérifier les mises à jour de Windows Live Toolbar.job
  
  ======Registry dump======
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
  Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 440384]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
  Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
  Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2008-04-03 1372160]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
  RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2009-05-04 312928]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
  IEVkbdBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll [2008-07-29 62728]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
  DriveLetterAccess - C:\WINDOWS\System32\DLA\DLASHX_W.DLL [2005-08-01 110652]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
  Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
  Adobe PDF Conversion Toolbar Helper - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2005-09-23 231160]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
  Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-05-19 668656]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
  Windows Live Toolbar Helper - C:\Program Files\Windows Live Toolbar\msntb.dll [2007-10-19 546320]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Windows Live Toolbar - C:\Program Files\Windows Live Toolbar\msntb.dll [2007-10-19 546320]
  {47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2005-09-23 231160]
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  "Tvs"=C:\Program Files\TOSHIBA\Tvs\TvsTray.exe [2005-11-30 73728]
  "THotkey"=C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe [2005-12-08 352256]
  "SynTPLpr"=C:\Program Files\Synaptics\SynTP\SynTPLpr.exe [2004-10-14 98394]
  "SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2004-10-14 688218]
  "LtMoh"=C:\Program Files\ltmoh\Ltmoh.exe [2005-05-19 188416]
  "DLA"=C:\WINDOWS\System32\DLA\DLACTRLW.EXE [2005-08-01 122940]
  "ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2005-08-05 344064]
  "AGRSMMSG"=C:\WINDOWS\AGRSMMSG.exe [2005-10-15 88203]
  ""= []
  "HPUsageTracking"=C:\Program Files\HP\HP UT\bin\hppusg.exe [2007-11-02 36864]
  "PrnStatusMX"=C:\Program Files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe [2007-07-13 1077248]
  "TkBellExe"=C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [2009-05-04 198160]
  "Adobe Reader Speed Launcher"=C:\Program Files\Reader\Reader_sl.exe [2009-02-27 35696]
  "AVP"=C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-05-24 206088]
  
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
  "TOSCDSPD"=C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe [2005-04-11 65536]
  "MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]
  "swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-05-19 39408]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
  []
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
  C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe []
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-12-11 49152]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
  C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  "AppInit_DLLS"="acaptuser32.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll"
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
  C:\WINDOWS\system32\klogon.dll [2008-07-29 218376]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
  
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
  "NoDrives"=0
  "NoDriveTypeAutoRun"=145
  "NoFolderOptions"=0
  "NoFind"=0
  "NoRun"=0
  "NoDriveAutoRun"=FFFFFFFF
  "HonorAutoRunSetting"=1
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
  "NoDriveTypeAutoRun"=
  "NoDrives"=
  "NoDriveAutoRun"=
  "NoFolderOptions"=
  "HonorAutoRunSetting"=
  
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
  "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
  "C:\Program Files\Macromedia\Fireworks MX\Fireworks.exe"="C:\Program Files\Macromedia\Fireworks MX\Fireworks.exe:*:Disabled:Fireworks MX"
  "C:\Program Files\EasyPHP\mysql\bin\mysqld-nt.exe"="C:\Program Files\EasyPHP\mysql\bin\mysqld-nt.exe:*:Disabled:mysqld-nt"
  "C:\Program Files\EasyPHP\apache\Apache.exe"="C:\Program Files\EasyPHP\apache\Apache.exe:*:Disabled:Apache"
  "C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe"="C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe:*:Disabled:Dreamweaver MX"
  "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
  "C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.325\French\setup.exe"="C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.325\French\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0"
  "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
  "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
  "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
  "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
  "C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
  "C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
  "C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
  "C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
  "C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
  "C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
  "C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
  "C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
  "C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
  "C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
  "C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
  "C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
  "C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
  "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
  "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
  "C:\Program Files\Free Download Manager\fdm.exe"="C:\Program Files\Free Download Manager\fdm.exe:*:Enabled:Free Download Manager"
  "C:\Documents and Settings\toshiba\Local Settings\Temp\IXP000.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe"="C:\Documents and Settings\toshiba\Local Settings\Temp\IXP000.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe:*:Enabled:C:\DOCUME~1\toshiba\LOCALS~1\Temp\IXP000.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe"
  "C:\Documents and Settings\toshiba\Local Settings\Temp\IXP001.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe"="C:\Documents and Settings\toshiba\Local Settings\Temp\IXP001.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe:*:Enabled:C:\DOCUME~1\toshiba\LOCALS~1\Temp\IXP001.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe"
  "C:\WINDOWS\system32\winudp64.exe"="C:\WINDOWS\system32\winudp64.exe:*:Disabled:winudp64"
  
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
  "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
  "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
  "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
  "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
  
  ======File associations======
  
  .js - open - "C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe" "%1"
  
  ======List of files/folders created in the last 1 months======
  
  2009-06-09 13:30:13 ----D---- C:\Documents and Settings\toshiba\Application Data\Malwarebytes
  2009-06-09 13:29:56 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
  2009-06-09 13:29:55 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
  2009-06-09 13:15:37 ----RASHD---- C:\autorun.inf
  2009-06-09 13:11:52 ----A---- C:\UsbFix.txt
  2009-06-09 03:09:15 ----D---- C:\_OTM
  2009-06-09 02:19:40 ----D---- C:\UsbFix
  2009-06-09 02:04:08 ----A---- C:\TB.txt
  2009-06-09 02:02:37 ----D---- C:\ToolBar SD
  2009-06-08 00:37:23 ----D---- C:\Program Files\trend micro
  2009-06-08 00:37:18 ----D---- C:\rsit
  2009-05-31 17:58:05 ----A---- C:\WINDOWS\pxinstall_log.txt
  2009-05-31 17:41:42 ----A---- C:\ibvdq.exe
  2009-05-31 17:40:28 ----A---- C:\orves.exe
  2009-05-31 17:40:02 ----A---- C:\karg.exe
  2009-05-31 02:42:22 ----A---- C:\WINDOWS\system32\win.txt
  2009-05-31 02:42:22 ----A---- C:\WINDOWS\system32\2.txt
  2009-05-31 02:42:22 ----A---- C:\WINDOWS\system32\1.txt
  2009-05-31 02:17:17 ----D---- C:\Program Files\Hotspot Shield
  2009-05-30 20:51:30 ----D---- C:\Documents and Settings\toshiba\Application Data\Boost Windows
  2009-05-30 20:51:07 ----D---- C:\Program Files\Boost Windows
  2009-05-30 15:04:09 ----D---- C:\Documents and Settings\toshiba\Application Data\NCH Software
  2009-05-29 03:06:39 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
  2009-05-29 03:06:31 ----HDC---- C:\WINDOWS\$NtUninstallKB961373$
  2009-05-29 03:05:59 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
  2009-05-29 03:05:31 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
  2009-05-29 03:05:14 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
  2009-05-29 03:04:00 ----HDC---- C:\WINDOWS\$NtUninstallKB960715$
  2009-05-29 03:02:39 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
  2009-05-29 03:02:30 ----HDC---- C:\WINDOWS\$NtUninstallKB958690$
  2009-05-29 03:02:15 ----HDC---- C:\WINDOWS\$NtUninstallKB959772_WM11$
  2009-05-27 23:52:25 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
  2009-05-26 06:30:40 ----HDC---- C:\WINDOWS\$NtUninstallKB963027$
  2009-05-24 19:28:55 ----D---- C:\Program Files\Kaspersky Lab
  2009-05-24 11:51:54 ----D---- C:\My Downloads
  2009-05-23 11:00:30 ----D---- C:\Program Files\Esl
  2009-05-23 10:59:45 ----D---- C:\Program Files\Resource
  2009-05-23 10:59:44 ----D---- C:\Program Files\Setup Files
  2009-05-23 10:59:44 ----D---- C:\Program Files\Reader
  2009-05-20 23:38:58 ----D---- C:\b0bbdf5af1c95e7967
  2009-05-20 08:59:24 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
  2009-05-19 21:11:15 ----D---- C:\Program Files\Apple Software Update
  2009-05-19 21:11:15 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
  2009-05-19 14:31:09 ----D---- C:\Program Files\WinZip
  2009-05-19 13:24:34 ----D---- C:\98f07633941d0b5a64
  2009-05-19 12:47:04 ----HDC---- C:\Documents and Settings\All Users\Application Data\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}
  2009-05-19 12:06:56 ----D---- C:\cc5dd750a86c1436d5e77e9d2e
  2009-05-19 12:05:04 ----RHD---- C:\AHCache
  2009-05-19 00:16:54 ----D---- C:\Documents and Settings\All Users\Application Data\Google Updater
  2009-05-16 22:57:00 ----D---- C:\Program Files\NCH Swift Sound
  2009-05-16 22:45:52 ----D---- C:\Program Files\Sagasoft
  2009-05-16 01:33:36 ----D---- C:\Documents and Settings\toshiba\Application Data\Uniblue
  2009-05-16 01:33:11 ----D---- C:\Program Files\Uniblue
  2009-05-16 01:20:21 ----HDC---- C:\Documents and Settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
  2009-05-14 14:56:33 ----D---- C:\Program Files\Foxit Software
  2009-05-14 14:56:33 ----D---- C:\Documents and Settings\toshiba\Application Data\Foxit
  2009-05-11 15:09:15 ----D---- C:\Program Files\Fichiers communs\Windows Live
  
  ======List of files/folders modified in the last 1 months======
  
  2009-06-09 22:31:56 ----D---- C:\WINDOWS\Prefetch
  2009-06-09 20:27:28 ----D---- C:\WINDOWS\temp
  2009-06-09 20:09:36 ----D---- C:\Program Files\Mozilla Firefox
  2009-06-09 20:08:21 ----D---- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
  2009-06-09 20:06:56 ----D---- C:\WINDOWS\system32\ias
  2009-06-09 20:05:42 ----SD---- C:\WINDOWS\Tasks
  2009-06-09 20:04:21 ----A---- C:\WINDOWS\SchedLgU.Txt
  2009-06-09 15:18:19 ----D---- C:\WINDOWS\system32\drivers
  2009-06-09 15:18:19 ----D---- C:\WINDOWS
  2009-06-09 15:15:43 ----D---- C:\WINDOWS\system32
  2009-06-09 13:29:55 ----D---- C:\Program Files
  2009-06-09 13:21:30 ----SHD---- C:\System Volume Information
  2009-06-09 13:21:20 ----SHD---- C:\RECYCLER
  2009-06-09 03:09:16 ----D---- C:\Documents and Settings\toshiba\Application Data\uTorrent
  2009-06-08 02:54:48 ----A---- C:\WINDOWS\NeroDigital.ini
  2009-06-07 11:39:15 ----HD---- C:\Config.Msi
  2009-06-07 11:12:04 ----SHD---- C:\WINDOWS\Installer
  2009-06-07 11:11:18 ----D---- C:\WINDOWS\system32\CatRoot
  2009-06-07 11:09:49 ----HD---- C:\WINDOWS\inf
  2009-06-07 00:55:50 ----D---- C:\WINDOWS\system32\CatRoot2
  2009-06-07 00:15:53 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
  2009-06-01 02:33:38 ----A---- C:\WINDOWS\system.ini
  2009-05-31 02:12:30 ----D---- C:\Documents and Settings
  2009-05-31 00:31:23 ----A---- C:\WINDOWS\wininit.ini
  2009-05-30 20:59:56 ----D---- C:\Program Files\Maestria
  2009-05-30 20:59:56 ----D---- C:\Program Files\ActDrv100
  2009-05-30 20:59:55 ----D---- C:\WINDOWS\system32\NtmsData
  2009-05-30 20:59:55 ----D---- C:\WINDOWS\system32\config
  2009-05-30 20:59:55 ----D---- C:\WINDOWS\repair
  2009-05-30 20:59:55 ----D---- C:\WINDOWS\Help
  2009-05-30 00:48:00 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
  2009-05-30 00:45:42 ----D---- C:\Documents and Settings\toshiba\Application Data\NCH Swift Sound
  2009-05-29 03:35:21 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
  2009-05-29 03:29:42 ----D---- C:\WINDOWS\system32\wbem
  2009-05-29 03:29:41 ----D---- C:\WINDOWS\AppPatch
  2009-05-29 03:06:42 ----RSHDC---- C:\WINDOWS\system32\dllcache
  2009-05-29 03:06:23 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared
  2009-05-29 03:05:26 ----HD---- C:\WINDOWS\$hf_mig$
  2009-05-29 03:05:01 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
  2009-05-29 03:04:38 ----RSD---- C:\WINDOWS\assembly
  2009-05-29 03:02:25 ----D---- C:\Program Files\Windows Media Player
  2009-05-23 11:00:25 ----D---- C:\Program Files\Fichiers communs\Adobe
  2009-05-22 23:19:56 ----D---- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
  2009-05-20 23:25:37 ----D---- C:\Program Files\Google
  2009-05-20 23:09:35 ----D---- C:\Program Files\Fichiers communs\Wise Installation Wizard
  2009-05-20 22:42:53 ----D---- C:\WINDOWS\Registration
  2009-05-20 20:02:57 ----D---- C:\WINDOWS\SoftwareDistribution
  2009-05-20 11:52:31 ----A---- C:\WINDOWS\powervideotoaudio.ini
  2009-05-20 11:50:09 ----A---- C:\WINDOWS\m3jpeg.ini
  2009-05-20 09:09:58 ----D---- C:\WINDOWS\Microsoft.NET
  2009-05-19 22:52:40 ----HD---- C:\Program Files\InstallShield Installation Information
  2009-05-19 22:52:36 ----D---- C:\Documents and Settings\toshiba\Application Data\COWON
  2009-05-19 22:52:27 ----D---- C:\Program Files\Fichiers communs
  2009-05-19 21:09:42 ----D---- C:\Documents and Settings\toshiba\Application Data\Nokia Multimedia Player
  2009-05-19 14:32:35 ----D---- C:\Documents and Settings\All Users\Application Data\WinZip
  2009-05-19 13:21:36 ----D---- C:\WINDOWS\WinSxS
  2009-05-19 00:33:30 ----D---- C:\Documents and Settings\toshiba\Application Data\Google
  2009-05-17 22:18:26 ----D---- C:\Program Files\Adobe
  2009-05-16 23:56:47 ----D---- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
  2009-05-16 23:09:17 ----D---- C:\Program Files\NCH Software
  2009-05-16 22:47:42 ----A---- C:\WINDOWS\powermp3wavconverter.ini
  2009-05-12 23:55:52 ----D---- C:\WINDOWS\network diagnostic
  2009-05-12 14:04:52 ----D---- C:\Program Files\Free Download Manager
  2009-05-12 13:56:40 ----A---- C:\WINDOWS\CD_SearchHistory.INI
  2009-05-12 00:45:38 ----D---- C:\WINDOWS\system32\Lang
  2009-05-11 15:09:13 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
  2009-05-10 02:30:42 ----D---- C:\Downloads
  
  ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
  
  R1 DLACDBHM;DLACDBHM; C:\WINDOWS\System32\Drivers\DLACDBHM.SYS [2005-07-07 5628]
  R1 DLARTL_N;DLARTL_N; C:\WINDOWS\System32\Drivers\DLARTL_N.SYS [2005-07-07 22684]
  R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 40576]
  R1 KLIF;Kaspersky Lab Driver; C:\WINDOWS\system32\DRIVERS\klif.sys [2009-05-24 213520]
  R1 WS2IFSL;Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-05 12032]
  R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.2.0.3; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2006-05-30 17801]
  R2 DLABOIOM;DLABOIOM; C:\WINDOWS\System32\DLA\DLABOIOM.SYS [2005-08-01 25628]
  R2 DLADResN;DLADResN; C:\WINDOWS\System32\DLA\DLADResN.SYS [2005-08-01 2496]
  R2 DLAIFS_M;DLAIFS_M; C:\WINDOWS\System32\DLA\DLAIFS_M.SYS [2005-08-01 86524]
  R2 DLAOPIOM;DLAOPIOM; C:\WINDOWS\System32\DLA\DLAOPIOM.SYS [2005-08-01 14684]
  R2 DLAPoolM;DLAPoolM; C:\WINDOWS\System32\DLA\DLAPoolM.SYS [2005-08-01 6364]
  R2 DLAUDF_M;DLAUDF_M; C:\WINDOWS\System32\DLA\DLAUDF_M.SYS [2005-08-01 87004]
  R2 DLAUDFAM;DLAUDFAM; C:\WINDOWS\System32\DLA\DLAUDFAM.SYS [2005-08-01 92700]
  R2 DRVNDDM;DRVNDDM; C:\WINDOWS\System32\Drivers\DRVNDDM.SYS [2005-07-07 40544]
  R2 Netdevio;TOSHIBA Network Device Usermode I/O Protocol; C:\WINDOWS\system32\DRIVERS\netdevio.sys [2003-01-29 12032]
  R3 AgereSoftModem;TOSHIBA V92 Software Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2005-11-15 1122656]
  R3 AR5211;Atheros Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ar5211.sys [2005-09-12 468736]
  R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
  R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-08-04 1273344]
  R3 CmBatt;Pilote pour Batterie à méthode de contrôle ACPI Microsoft; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
  R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
  R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2005-11-11 4064256]
  R3 Iviaspi;IVI ASPI Shell; C:\WINDOWS\system32\drivers\iviaspi.sys [2003-09-10 21060]
  R3 KLFLTDEV;Kaspersky Lab KLFltDev; C:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
  R3 NCHSSVAD;SoundTap Recorder; C:\WINDOWS\system32\drivers\nchssvad.sys [2009-05-16 27136]
  R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
  R3 Pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2003-09-19 10368]
  R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys [2005-03-04 74496]
  R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2004-10-14 185728]
  R3 TVALD;Toshiba Mobile PC Service; C:\WINDOWS\system32\DRIVERS\NBSMI.sys [2005-10-20 6144]
  R3 Tvs;TOSHIBA Virtual Sound with SRS technologies; C:\WINDOWS\system32\DRIVERS\Tvs.sys [2005-11-30 43392]
  R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
  R3 usbhub;Pilote de concentrateur standard USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
  R3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
  S1 ASPI32;ASPI32; C:\WINDOWS\system32\drivers\ASPI32.sys []
  S1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14720]
  S2 RapidPort;RapidPort; \??\C:\WINDOWS\system32\Drivers\CAPLPTN.SYS []
  S3 AVPsys;AVPsys; \??\C:\WINDOWS\system32\drivers\tdi.sys []
  S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
  S3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
  S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2007-07-05 49920]
  S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2007-07-05 16496]
  S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2007-07-05 21568]
  S3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-04-30 24592]
  S3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
  S3 Nokia USB Generic;Nokia USB Generic; C:\WINDOWS\system32\drivers\nmwcdc.sys [2006-05-29 8704]
  S3 Nokia USB Modem;Nokia USB Modem; C:\WINDOWS\system32\drivers\nmwcdcm.sys [2006-05-29 13312]
  S3 Nokia USB Phone Parent;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\nmwcd.sys [2006-05-29 127488]
  S3 rtl8139;Pilote NT de carte Realtek PCI Fast Ethernet à base RTL8139(A/B/C); C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
  S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
  S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
  S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
  S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
  S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
  S3 zmNTZip;zmNTZip; \??\C:\Program Files\ZipMagic\zmNTZip.sys []
  S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
  
  ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
  
  R2 ACS;Service de configuration Atheros; C:\WINDOWS\system32\acs.exe [2005-07-07 36864]
  R2 Adobe LM Service;Adobe LM Service; C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe [2007-12-03 69632]
  R2 astcc;AST Service; C:\WINDOWS\system32\AstSrv.exe [2007-06-20 53248]
  R2 CFSvcs;ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [2005-01-18 40960]
  R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance; C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe [2008-06-13 81920]
  R2 hpqddsvc;Service HP CUE DeviceDiscovery; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
  R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
  R2 Net Driver HPZ12;Net Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
  R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
  R2 TAPPSRV;TOSHIBA Application Service; C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe [2005-08-10 35328]
  R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance; C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe [2008-06-13 2723840]
  R3 hpqcxs08;hpqcxs08; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
  S2 AVP;Kaspersky Internet Security; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-05-24 206088]
  S2 gupdate1c9d80fecd7376a;Service Google Update (gupdate1c9d80fecd7376a); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-05-19 133104]
  S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-19 183280]
  S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
  S3 bepldr;BCL easyPDF SDK 5 Loader; C:\Program Files\Fichiers communs\BCL Technologies\easyPDF 5\bepldr.exe [2008-02-07 151552]
  S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
  S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
  S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
  S3 ServiceLayer;ServiceLayer; C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe [2006-06-05 174080]
  S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
  S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
  S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe []
  S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
  
  -----------------EOF-----------------
  
  0
  
  Réagir
Réponse 6 / 10
anthony5151 Contributeur sécurité
Parfait, j'attends le rapport de MalwareBytes maintenant :)

0

Réagir
1. monstre
  
  voila le rapport anti-malware
  Malwarebytes' Anti-Malware 1.37
  Version de la base de données: 2252
  Windows 5.1.2600 Service Pack 3
  
  09/06/2009 15:15:47
  mbam-log-2009-06-09 (15-15-46).txt
  
  Type de recherche: Examen complet (C:\|)
  Eléments examinés: 246283
  Temps écoulé: 1 hour(s), 37 minute(s), 52 second(s)
  
  Processus mémoire infecté(s): 0
  Module(s) mémoire infecté(s): 0
  Clé(s) du Registre infectée(s): 4
  Valeur(s) du Registre infectée(s): 4
  Elément(s) de données du Registre infecté(s): 0
  Dossier(s) infecté(s): 5
  Fichier(s) infecté(s): 38
  
  Processus mémoire infecté(s):
  (Aucun élément nuisible détecté)
  
  Module(s) mémoire infecté(s):
  (Aucun élément nuisible détecté)
  
  Clé(s) du Registre infectée(s):
  HKEY_CLASSES_ROOT\CLSID\{035c1836-0d78-dabc-f4a7-d5d0517ee1f9} (Rogue.MalwareWiped) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
  HKEY_CLASSES_ROOT\AppID\MalwareWipe.EXE (Rogue.MalwareWiped) -> Quarantined and deleted successfully.
  
  Valeur(s) du Registre infectée(s):
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nvd32_r (Trojan.Agent) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\diskchk help (Trojan.Downloader) -> Quarantined and deleted successfully.
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\FirstInstallFlag (Malware.Trace) -> Quarantined and deleted successfully.
  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\tuneup html client embedded web browser from: http://bsalsa.com/ (Trojan.Banker) -> Quarantined and deleted successfully.
  
  Elément(s) de données du Registre infecté(s):
  (Aucun élément nuisible détecté)
  
  Dossier(s) infecté(s):
  c:\documents and settings\all users\application data\WinAntiVirus Pro 2006 (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
  c:\documents and settings\mondher arfaoui\application data\WinAntiVirus Pro 2006 (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
  c:\documents and settings\mondher arfaoui\application data\winantivirus pro 2006\Logs (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
  c:\documents and settings\toshiba\application data\WinAntiVirus Pro 2006 (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
  c:\documents and settings\toshiba\application data\winantivirus pro 2006\Logs (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
  
  Fichier(s) infecté(s):
  c:\QooBox\quarantine\C\WINDOWS\emde.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
  c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP190\A0074571.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP190\A0074586.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP190\A0074671.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP190\A0074693.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP190\A0074706.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP190\A0075706.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP191\A0075715.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP191\A0076717.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP193\A0077749.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP193\A0077775.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP193\A0077833.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP193\A0077846.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP194\A0077879.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP194\A0077867.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP194\A0077907.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP194\A0078002.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  c:\system volume information\_restore{7c613a87-bf99-4606-961b-887f813d12f7}\RP195\A0080263.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  c:\WINDOWS\system32\drivers\oc-cd.exe (Trojan.Agent) -> Quarantined and deleted successfully.
  c:\documents and settings\all users\application data\winantivirus pro 2006\AVScheduler.dat (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
  c:\documents and settings\mondher arfaoui\application data\winantivirus pro 2006\Logs\Activate.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
  c:\documents and settings\mondher arfaoui\application data\winantivirus pro 2006\Logs\wa6Support.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
  c:\documents and settings\mondher arfaoui\application data\winantivirus pro 2006\Logs\winav.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
  c:\documents and settings\toshiba\application data\winantivirus pro 2006\DownloadWA6P.url (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
  c:\documents and settings\toshiba\application data\winantivirus pro 2006\Logs\Activate.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
  c:\documents and settings\toshiba\application data\winantivirus pro 2006\Logs\wa6Support.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
  c:\documents and settings\toshiba\application data\winantivirus pro 2006\Logs\winav.log (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
  C:\Documents and Settings\toshiba\Application Data\unobi.dll (Trojan.Agent) -> Quarantined and deleted successfully.
  c:\documents and settings\toshiba\Favoris\Online Security Test.url (Rogue.Link) -> Quarantined and deleted successfully.
  c:\documents and settings\all users\menu démarrer\Online Security Guide.url (Rogue.Link) -> Quarantined and deleted successfully.
  c:\documents and settings\all users\menu démarrer\Security Troubleshooting.url (Rogue.Link) -> Quarantined and deleted successfully.
  c:\documents and settings\toshiba\Favoris\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
  c:\documents and settings\toshiba\Favoris\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
  c:\documents and settings\toshiba\Favoris\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
  C:\WINDOWS\SHELLNEW\RakyatKelaparan.exe (Worm.Brontok) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\cmd-brontok.exe (Worm.Brontok) -> Quarantined and deleted successfully.
  C:\Documents and Settings\All Users\proto.dll (Trojan.Downloader) -> Quarantined and deleted successfully.
  C:\WINDOWS\system32\drivers\svchost.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
  
  0
  
  Réagir
Réponse 7 / 10
anthony5151 Contributeur sécurité
Ok, on continue :

• Branche tous tes disques amovibles (clés USB, lecteurs mp3, disques durs externes, iPod...) et clique sur OK.
• Relance USBFix
• Choisis cette fois l'option 2 (Suppression)
• Ton Bureau va disparaitre, puis l'ordinateur va redémarrer --> c'est normal
• Laisse travailler l'outil jusqu'au bout
• A la fin, le rapport USBFix.txt va s'afficher --> poste le dans ta prochaine réponse stp

Ensuite, fais ce scan généraliste :

• Télécharge et installe Malwarebytes' Anti-Malware
• A la fin de l'installation, veille à ce que l'option « mettre a jour Malwarebyte's Anti-Malware » soit cochée
• Lance MBAM et laisse les Mises à jour se télécharger (sinon fais les manuellement au lancement du programme)
• Puis va dans l'onglet "Recherche", coche "Exécuter un examen complet" puis "Rechercher"
• Sélectionne tes disques durs" puis clique sur "Lancer l’examen"
• A la fin du scan, clique sur Afficher les résultats
• Coche tous les éléments détectés puis clique sur Supprimer la sélection
• Enregistre le rapport
• S'il t'est demandé de redémarrer, clique sur Yes

• Poste dans ta prochaine réponse le rapport apparaissant après la suppression stp

0

Réagir
1. monstre
  
  voila le rapport USBFix.txt
  
  ############################## [ UsbFix V3.029 | Cleaning ]
  
  # User : toshiba () # ARFAOUI
  # Update on 05/06/09 by Chiquitine29, C_XX & Chimay8
  # WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
  # Start at: 13:12:06 | 09/06/2009
  
  # Intel(R) Celeron(R) M processor 1.50GHz
  # Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
  # Internet Explorer 6.0.2900.5512
  # Windows Firewall Status : Enabled
  # AV : Kaspersky Internet Security 8.0.0.454 [ (!) Disabled | Updated ]
  # FW : Kaspersky Internet Security[ (!) Disabled ]8.0.0.454
  
  # C:\ # Disque fixe local # 74.53 Go (17.89 Go free) # NTFS
  # D:\ # Disque CD-ROM
  # E:\ # Disque amovible # 994.86 Mo (580.06 Mo free) # FAT
  
  ############################## [ Processus actifs ]
  
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\logonui.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\acs.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
  C:\WINDOWS\system32\AstSrv.exe
  C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
  C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
  C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe
  C:\Program Files\Google\Update\GoogleUpdate.exe
  C:\Program Files\Google\Update\GoogleUpdate.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Google\Update\GoogleUpdate.exe
  C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
  C:\Program Files\Google\Update\GoogleUpdate.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
  C:\WINDOWS\system32\wbem\wmiprvse.exe
  
  ################## [ Fichiers # Dossiers infectieux ]
  
  E:\autorun.inf # -> fichier appelé : "E:\RECYCLER\help.exe" ( absent ! )
  Deleted ! E:\Setup.exe
  Deleted ! E:\autorun.inf
  
  ################## [ Registre # Clés Run infectieuses ]
  
  Deleted ! HKLM\software\microsoft\windows nt\currentversion\winlogon "Taskman"
  
  ################## [ Registre # Mountpoints2 ]
  
  ################## [ Listing des fichiers présent ]
  
  [06/01/2009 00:58|--a------|40] - C:\Auth.prof
  [24/09/2006 00:47|--ahs----|7] - C:\AUTOEXEC.BAT
  [19/09/2008 05:57|--ahs----|217] - C:\boot.ini
  [05/08/2004 12:00|-rahs----|4952] - C:\Bootfont.bin
  [02/10/2008 11:01|--a------|23732] - C:\ComboFix.txt
  [09/12/2005 07:03|--a------|0] - C:\CONFIG.SYS
  [17/09/2007 09:03|---hs----|72] - C:\desktop.ini
  [07/02/2009 13:20|--a------|12103] - C:\EyeCandyLog.txt
  [?|?|?] - C:\hiberfil.sys
  [31/05/2009 17:44|--a------|1420] - C:\ibvdq.exe
  [09/12/2005 07:03|-rahs----|0] - C:\IO.SYS
  [31/05/2009 17:40|--a------|0] - C:\karg.exe
  [08/07/2008 09:58|--a------|8] - C:\msconfig.bat
  [09/12/2005 07:03|-rahs----|0] - C:\MSDOS.SYS
  [05/08/2004 12:00|-rahs----|47564] - C:\NTDETECT.COM
  [17/09/2008 23:29|-rahs----|252240] - C:\ntldr
  [31/05/2009 17:40|--a------|1240] - C:\orves.exe
  [?|?|?] - C:\pagefile.sys
  [09/06/2009 02:08|--a------|6236] - C:\TB.txt
  [23/12/2008 16:57|--a------|594] - C:\updatedatfix.log
  [09/06/2009 13:15|--a------|3442] - C:\UsbFix.txt
  [22/07/2008 12:35|--a------|615936] - C:\WHT Certificate.XLS
  [09/06/2009 03:12|--a------|1774] - E:\BOOTEX.LOG
  [01/01/2003 22:18|--a------|11311] - E:\Password Administrateur.txt
  [28/09/2005 05:10|--a------|4349551] - E:\??????? ??????? ?? ?????? ????????? ???????.pdf
  
  ################## [ Vaccination ]
  
  # C:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.
  # E:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.
  
  ################## [ ! Fin du rapport # UsbFix V3.029 ! ]
  
  0
  
  Réagir
Réponse 8 / 10
anthony5151 Contributeur sécurité
Effectivement, le lien a changé : http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/

0

Réagir
1. monstre
  
  voila le rapport .log
  ========== PROCESSES ==========
  Process explorer.exe killed successfully.
  ========== FILES ==========
  C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky 2009 Internet Security keygen + activator - NOT ON BLACK LIST!.rar.1.torrent moved successfully.
  C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky 2009 Internet Security keygen + activator - NOT ON BLACK LIST!.rar.torrent moved successfully.
  C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky 2009 Keygen (Clean) (19 may) by THX.rar.torrent moved successfully.
  C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky 2009 Keygen Free.torrent moved successfully.
  C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky 2009 KeyGen.torrent moved successfully.
  C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky Internet Security 7.0 Newest Updated For Life Crack Serial 100%.torrent moved successfully.
  C:\DOCUME~1\toshiba\Application Data\uTorrent\NCH WavePad Sound Editor v3.12 + keygen.torrent moved successfully.
  C:\DOCUME~1\toshiba\Application Data\uTorrent\Total Video Converter 3.22 (Serial+Crack) & Total Video Converter 3.21 Portable.torrent moved successfully.
  C:\DOCUME~1\toshiba\Application Data\uTorrent\Windows Media Player 11 Final + WINDOWS VALIDATION CRACK.torrent moved successfully.
  C:\DOCUME~1\toshiba\Application Data\uTorrent\Winzip 11 Keygen {Tested n Working}.rar.torrent moved successfully.
  C:\DOCUME~1\toshiba\Application Data\uTorrent\Winzip 11 pro + keygen.zip.torrent moved successfully.
  C:\DOCUME~1\toshiba\Application Data\uTorrent\WinZip 11.1 Keygen.torrent moved successfully.
  C:\DOCUME~1\toshiba\Application Data\uTorrent\WinZip 11.1 PRO with keygen (Xp&Vista Compatible).torrent moved successfully.
  C:\DOCUME~1\toshiba\Application Data\uTorrent\WinZip 11.1 PRO with keygen WANTED FINAL.torrent moved successfully.
  C:\DOCUME~1\toshiba\Application Data\uTorrent\WinZip 12 + keygen.torrent moved successfully.
  C:\DOCUME~1\toshiba\Application Data\uTorrent\Winzip.11.inc.keygen-SshuggzZ.torrent moved successfully.
  C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\Kaspersky_2009_Anti_Virus_Keygen-Fenopy.com.torrent moved successfully.
  C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\Kaspersky_2009_Internet_Security_keygen_activator_NOT_ON_BLA-Fenopy.com(2).torrent moved successfully.
  C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\Kaspersky_2009_Internet_Security_keygen_activator_NOT_ON_BLA-Fenopy.com.torrent moved successfully.
  C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\Kaspersky_2009_Keygen_Clean_19_may_by_THX-Fenopy.com.torrent moved successfully.
  C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\Kaspersky_2009_Keygen_Free_-Fenopy.com.torrent moved successfully.
  C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\WavePad_3_12_keygen-Fenopy.com.torrent moved successfully.
  C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 11.1 PRO with keygen (Xp&Vista Compatible) moved successfully.
  C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 12 + keygen moved successfully.
  File/Folder C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 11.1 PRO with keygen (Xp&Vista Compatible)\winzip111_setup.exe not found.
  File/Folder C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 11.1 PRO with keygen (Xp&Vista Compatible)\Winzip11_Keygen.exe not found.
  File/Folder C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 12 + keygen\Installation Instructions.nfo not found.
  File/Folder C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 12 + keygen\keygen.exe not found.
  File/Folder C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 12 + keygen\winzip120.exe not found.
  C:\DOCUME~1\toshiba\Local Settings\Temp\wzaa58\keygen.exe moved successfully.
  C:\DOCUME~1\toshiba\Mes documents\Downloads\NCH WavePad Sound Editor v3.12 + keygen moved successfully.
  C:\DOCUME~1\toshiba\Recent\NCH WavePad Sound Editor v3.12 + keygen.lnk moved successfully.
  C:\DOCUME~1\toshiba\Recent\WavePad_3_12_keygen-Fenopy.com.torrent.lnk moved successfully.
  ========== COMMANDS ==========
  File delete failed. C:\DOCUME~1\toshiba\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\SLSXEF8X\38761747[1].htm scheduled to be deleted on reboot.
  File delete failed. C:\DOCUME~1\toshiba\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
  File delete failed. C:\DOCUME~1\toshiba\LOCALS~1\Temp\Historique\History.IE5\index.dat scheduled to be deleted on reboot.
  File delete failed. C:\DOCUME~1\toshiba\LOCALS~1\Temp\Cookies\index.dat scheduled to be deleted on reboot.
  File delete failed. C:\DOCUME~1\toshiba\LOCALS~1\Temp\etilqs_MJwjJRNKLvgScQfzyx0F scheduled to be deleted on reboot.
  File delete failed. C:\DOCUME~1\toshiba\LOCALS~1\Temp\~DF27DD.tmp scheduled to be deleted on reboot.
  User's Temp folder emptied.
  User's Internet Explorer cache folder emptied.
  User's Temporary Internet Files folder emptied.
  File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
  File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Historique\History.IE5\index.dat scheduled to be deleted on reboot.
  File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
  Local Service Temp folder emptied.
  Local Service Temporary Internet Files folder emptied.
  Network Service Temp folder emptied.
  File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
  Network Service Temporary Internet Files folder emptied.
  Windows Temp folder emptied.
  Java cache emptied.
  File delete failed. C:\Documents and Settings\toshiba\Local Settings\Application Data\Mozilla\Firefox\Profiles\cvv2dogc.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
  File delete failed. C:\Documents and Settings\toshiba\Local Settings\Application Data\Mozilla\Firefox\Profiles\cvv2dogc.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
  File delete failed. C:\Documents and Settings\toshiba\Local Settings\Application Data\Mozilla\Firefox\Profiles\cvv2dogc.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
  File delete failed. C:\Documents and Settings\toshiba\Local Settings\Application Data\Mozilla\Firefox\Profiles\cvv2dogc.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
  File delete failed. C:\Documents and Settings\toshiba\Local Settings\Application Data\Mozilla\Firefox\Profiles\cvv2dogc.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
  FireFox cache emptied.
  Temp folders emptied.
  Explorer started successfully
  
  OTM by OldTimer - Version 2.1.0.0 log created on 06092009_030915
  
  Files moved on Reboot...
  C:\DOCUME~1\toshiba\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\SLSXEF8X\38761747[1].htm moved successfully.
  File C:\DOCUME~1\toshiba\LOCALS~1\Temp\etilqs_MJwjJRNKLvgScQfzyx0F not found!
  C:\DOCUME~1\toshiba\LOCALS~1\Temp\~DF27DD.tmp moved successfully.
  C:\Documents and Settings\toshiba\Local Settings\Application Data\Mozilla\Firefox\Profiles\cvv2dogc.default\Cache\_CACHE_001_ moved successfully.
  C:\Documents and Settings\toshiba\Local Settings\Application Data\Mozilla\Firefox\Profiles\cvv2dogc.default\Cache\_CACHE_002_ moved successfully.
  C:\Documents and Settings\toshiba\Local Settings\Application Data\Mozilla\Firefox\Profiles\cvv2dogc.default\Cache\_CACHE_003_ moved successfully.
  C:\Documents and Settings\toshiba\Local Settings\Application Data\Mozilla\Firefox\Profiles\cvv2dogc.default\Cache\_CACHE_MAP_ moved successfully.
  C:\Documents and Settings\toshiba\Local Settings\Application Data\Mozilla\Firefox\Profiles\cvv2dogc.default\urlclassifier3.sqlite moved successfully.
  
  Registry entries deleted on Reboot...
  
  0
  
  Réagir
Réponse 9 / 10
anthony5151 Contributeur sécurité
Re,

Il y a une barre d'outil néfaste sur ton ordinateur (AskBar)... Pour éviter ce genre d'infection, il faut tout lire attentivement lorsque tu installes un programme gratuit, et décocher tous les programmes additionnels qui sont proposés, en particulier les barres d'outils !

• Télécharge Toolbar-S&D (de la team IDN) sur ton Bureau.
• Lance l'installation du programme en exécutant le fichier téléchargé.
• Double-clique maintenant sur le raccourci de Toolbar-S&D.
• Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
• Choisis directement l'option 2 (Suppression). Patiente jusqu'à la fin de la recherche.
• Poste le rapport généré. (C:\TB.txt)

Il semble aussi y avoir une infection qui se transmet par disque amovible (clé USB, disque dur externe, lecteur mp3, appareils photos numériques, téléphones portables...) : lorsque tu dois en brancher un sur ton ordinateur, il faut le vacciner avec USBFix avant de l'ouvrir.

• Télécharge UsbFix (de Chiquitine29 et C_XX) sur ton Bureau
• Lance l'installation avec les paramètres par défaut
• Branche tes sources de données externes à ton PC (clé USB, disque dur externe, lecteur mp3 etc...) sans les ouvrir
• Double clique sur le raccourci UsbFix sur ton Bureau
• Au menu principal, choisis l'option 1 (recherche)
• Un rapport USBFix.txt apparaitra à la fin, poste le dans ta prochaine réponse stp

0

Réagir
1. monstre
  
  voila le rapport tb.txt
  
  -----------\\ ToolBar S&D 1.2.8 XP/Vista
  
  Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
  X86-based PC ( Uniprocessor Free : Intel(R) Celeron(R) M processor 1.50GHz )
  BIOS : BIOS Version 1.50
  USER : toshiba ( Administrator )
  BOOT : Normal boot
  Antivirus : Kaspersky Internet Security 8.0.0.454 (Not Activated)
  Firewall : Kaspersky Internet Security 8.0.0.454 (Not Activated)
  C:\ (Local Disk) - NTFS - Total:74 Go (Free:17 Go)
  D:\ (CD or DVD)
  
  "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
  Option : [2] ( 09/06/2009| 2:04 )
  
  -----------\\ SUPPRESSION
  
  Supprime! - C:\Program Files\AskBarDis\bar
  Supprime! - C:\Program Files\AskBarDis\PopSwatter
  Supprime! - C:\Program Files\AskBarDis\unins000.dat
  Supprime! - C:\Program Files\AskBarDis\unins000.exe
  Supprime! - C:\Program Files\AskTBar\bar
  Supprime! - C:\Program Files\AskTBar\PopSwatr
  Supprime! - C:\Program Files\AskBarDis
  Supprime! - C:\Program Files\AskTBar
  Supprime! - C:\Program Files\KaZaA
  
  -----------\\ Recherche de Fichiers / Dossiers ...
  
  -----------\\ Extensions
  
  (toshiba) - {563e4790-7e70-11da-a72b-0800200c9a66} => clearcache
  (toshiba) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar
  (toshiba) - {84b24861-62f6-364b-eba5-2e5e2061d7e6} => mediaplayerconnectivity
  (toshiba) - {991A772A-BA13-4c1d-A9EF-F897F31DEC7D} => megaupload
  (toshiba) - {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} => adblockplus
  (toshiba) - {DDC359D1-844A-42a7-9AA1-88A850A938A8} => chrome
  
  -----------\\ [..\Internet Explorer\Main]
  
  [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
  "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
  "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
  "Start Page"="https://www.google.com/?gws_rd=ssl"
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
  "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
  "Default_Search_URL"="http://toolbar.ask.com/toolbarv/askRedirect?o=101699&gct=&gc=1&q="
  "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
  "Start Page"="https://www.msn.com/fr-fr/"
  
  --------------------\\ Recherche d'autres infections
  
  --------------------\\ ROGUES ..
  
  C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinAntiVirus Pro 2006
  C:\DOCUME~1\MONDHE~1\APPLIC~1\WinAntiVirus Pro 2006
  C:\DOCUME~1\toshiba\APPLIC~1\WinAntiVirus Pro 2006
  
  --------------------\\ Cracks & Keygens ..
  
  C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky 2009 Internet Security keygen + activator - NOT ON BLACK LIST!.rar.1.torrent
  C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky 2009 Internet Security keygen + activator - NOT ON BLACK LIST!.rar.torrent
  C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky 2009 Keygen (Clean) (19 may) by THX.rar.torrent
  C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky 2009 Keygen Free.torrent
  C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky 2009 KeyGen.torrent
  C:\DOCUME~1\toshiba\Application Data\uTorrent\Kaspersky Internet Security 7.0 Newest Updated For Life Crack Serial 100%.torrent
  C:\DOCUME~1\toshiba\Application Data\uTorrent\NCH WavePad Sound Editor v3.12 + keygen.torrent
  C:\DOCUME~1\toshiba\Application Data\uTorrent\Total Video Converter 3.22 (Serial+Crack) & Total Video Converter 3.21 Portable.torrent
  C:\DOCUME~1\toshiba\Application Data\uTorrent\Windows Media Player 11 Final + WINDOWS VALIDATION CRACK.torrent
  C:\DOCUME~1\toshiba\Application Data\uTorrent\Winzip 11 Keygen {Tested n Working}.rar.torrent
  C:\DOCUME~1\toshiba\Application Data\uTorrent\Winzip 11 pro + keygen.zip.torrent
  C:\DOCUME~1\toshiba\Application Data\uTorrent\WinZip 11.1 Keygen.torrent
  C:\DOCUME~1\toshiba\Application Data\uTorrent\WinZip 11.1 PRO with keygen (Xp&Vista Compatible).torrent
  C:\DOCUME~1\toshiba\Application Data\uTorrent\WinZip 11.1 PRO with keygen WANTED FINAL.torrent
  C:\DOCUME~1\toshiba\Application Data\uTorrent\WinZip 12 + keygen.torrent
  C:\DOCUME~1\toshiba\Application Data\uTorrent\Winzip.11.inc.keygen-SshuggzZ.torrent
  C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\Kaspersky_2009_Anti_Virus_Keygen-Fenopy.com.torrent
  C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\Kaspersky_2009_Internet_Security_keygen_activator_NOT_ON_BLA-Fenopy.com(2).torrent
  C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\Kaspersky_2009_Internet_Security_keygen_activator_NOT_ON_BLA-Fenopy.com.torrent
  C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\Kaspersky_2009_Keygen_Clean_19_may_by_THX-Fenopy.com.torrent
  C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\Kaspersky_2009_Keygen_Free_-Fenopy.com.torrent
  C:\DOCUME~1\toshiba\Bureau\adel1\telechargement\WavePad_3_12_keygen-Fenopy.com.torrent
  C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 11.1 PRO with keygen (Xp&Vista Compatible)
  C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 12 + keygen
  C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 11.1 PRO with keygen (Xp&Vista Compatible)\winzip111_setup.exe
  C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 11.1 PRO with keygen (Xp&Vista Compatible)\Winzip11_Keygen.exe
  C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 12 + keygen\Installation Instructions.nfo
  C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 12 + keygen\keygen.exe
  C:\DOCUME~1\toshiba\Bureau\logiciels\WinZip 12 + keygen\winzip120.exe
  C:\DOCUME~1\toshiba\Local Settings\Temp\wzaa58\keygen.exe
  C:\DOCUME~1\toshiba\Mes documents\Downloads\NCH WavePad Sound Editor v3.12 + keygen
  C:\DOCUME~1\toshiba\Mes documents\Downloads\NCH WavePad Sound Editor v3.12 + keygen\AT4RE.nfo
  C:\DOCUME~1\toshiba\Mes documents\Downloads\NCH WavePad Sound Editor v3.12 + keygen\Keygen.exe
  C:\DOCUME~1\toshiba\Mes documents\Downloads\NCH WavePad Sound Editor v3.12 + keygen\wpsetup.exe
  C:\DOCUME~1\toshiba\Recent\NCH WavePad Sound Editor v3.12 + keygen.lnk
  C:\DOCUME~1\toshiba\Recent\WavePad_3_12_keygen-Fenopy.com.torrent.lnk
  
  1 - "C:\ToolBar SD\TB_1.txt" - 09/06/2009| 2:08 - Option : [2]
  
  -----------\\ Fin du rapport a 2:08:22.46
  
  0
  
  Réagir
2. monstre
  
  @monstrevoila le rapport USBfix
  
  ############################## [ UsbFix V3.029 | Scan ]
  
  # User : toshiba () # ARFAOUI
  # Update on 05/06/09 by Chiquitine29, C_XX & Chimay8
  # WebSite : http://pagesperso-orange.fr/NosTools/usbfix.html
  # Start at: 02:23:29 | 09/06/2009
  
  # Intel(R) Celeron(R) M processor 1.50GHz
  # Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
  # Internet Explorer 6.0.2900.5512
  # Windows Firewall Status : Disabled
  # AV : Kaspersky Internet Security 8.0.0.454 [ (!) Disabled | Updated ]
  # FW : Kaspersky Internet Security[ (!) Disabled ]8.0.0.454
  
  # C:\ # Disque fixe local # 74.53 Go (17.89 Go free) # NTFS
  # D:\ # Disque CD-ROM
  # E:\ # Disque amovible # 994.86 Mo (580.08 Mo free) # FAT
  
  ############################## [ Processus actifs ]
  
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\acs.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
  C:\WINDOWS\system32\AstSrv.exe
  C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
  C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe
  C:\Program Files\Google\Update\GoogleUpdate.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
  C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
  C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\ltmoh\Ltmoh.exe
  C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\WINDOWS\AGRSMMSG.exe
  C:\Program Files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe
  C:\WINDOWS\System32\alg.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\WINDOWS\explorer.exe
  C:\WINDOWS\system32\drivers\svchost.exe
  C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
  C:\WINDOWS\system32\wscntfy.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\WINDOWS\system32\wbem\wmiprvse.exe
  
  ################## [ Registre Startup ]
  
  HKCU_Main: "Local Page"="C:\\WINDOWS\\system32\\blank.htm"
  HKCU_Main: "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
  HKCU_Main: "Start Page"="https://www.google.com/?gws_rd=ssl"
  HKLM_logon: "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
  HKLM_logon: "DefaultUserName"="toshiba"
  HKLM_logon: "AltDefaultUserName"="toshiba"
  HKLM_logon: "LegalNoticeCaption"=""
  HKLM_logon: "LegalNoticeText"=""
  HKLM_Run: Tvs=C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
  HKLM_Run: THotkey=C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
  HKLM_Run: SynTPLpr=C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  HKLM_Run: SynTPEnh=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  HKLM_Run: LtMoh=C:\Program Files\ltmoh\Ltmoh.exe
  HKLM_Run: DLA=C:\WINDOWS\System32\DLA\DLACTRLW.EXE
  HKLM_Run: ATIPTA="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
  HKLM_Run: AGRSMMSG=AGRSMMSG.exe
  HKLM_Run: HPUsageTracking="C:\Program Files\HP\HP UT\bin\hppusg.exe" "C:\Program Files\HP\HP UT"
  HKLM_Run: PrnStatusMX=C:\Program Files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe
  HKLM_Run: TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
  HKLM_Run: Adobe Reader Speed Launcher="C:\Program Files\Reader\Reader_sl.exe"
  HKLM_Run: AVP="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
  HKLM_Run: HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
  HKCU_Run: ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
  HKCU_Run: TOSCDSPD=C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
  HKCU_Run: MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background
  HKCU_Run: swg=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
  HKCU_Run: nvd32_r=rundll32.exe "C:\Documents and Settings\toshiba\Application Data\unobi.dll" s
  HKCU_Run: DiskChk help=rundll32.exe "C:\Documents and Settings\All Users\proto.dll" run
  
  ################## [ Fichiers # Dossiers infectieux ]
  
  Found ! C:\DOCUME~1\toshiba\LOCALS~1\Temp\wzaa58\keygen.exe
  E:\autorun.inf # -> fichier appelé : "E:\RECYCLER\help.exe" ( absent ! )
  Found ! E:\lad.bat
  Found ! E:\Setup.exe
  Found ! E:\autorun.inf
  Found ! "E:\RECYCLER\S-1-6-21-2434476501-1644491937-600003330-1213"
  
  ################## [ Registre # Clés Run infectieuses ]
  
  Found ! HKLM\software\microsoft\windows nt\currentversion\winlogon "Taskman"
  
  ################## [ Registre # Mountpoints2 ]
  
  ################## [ ! Fin du rapport # UsbFix V3.029 ! ]
  
  0
  
  Réagir
Réponse 10 / 10
anthony5151 Contributeur sécurité
Bonsoir,

Peux-tu utiliser ce logiciel de diagnostic stp, ça me permettra de t'aider :

• Télécharge Random's System Information Tool (RSIT) de random/random, et enregistre le sur ton Bureau.
• Double clique sur RSIT.exe pour lancer l'outil.
• Clique sur ' continue ' à l'écran Disclaimer.
• Si l'outil HijackThis n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
• Une fois le scan terminé, deux rapports vont apparaître : poste les dans deux messages séparés

Tutoriel illustré pour t'aider : https://www.androidworld.fr/

0

Réagir
1. monstre
  
  j'ai deux fichier teste es que je copier coller dans un message?
  
  0
  
  Réagir
2. monstre
  
  info.txt logfile of random's system information tool 1.06 2009-06-08 00:37:51
  
  ======Uninstall list======
  
  -->C:\Program Files\DivX\ConverterUninstall.exe /CONVERTER
  -->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
  -->C:\Program Files\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
  -->C:\WINDOWS\IsUn040c.exe -fC:\WINDOWS\orun32.isu
  -->C:\WINDOWS\system32\\MSIEXEC.EXE /x {1206EF92-2E83-4859-ACCB-2048C3CB7DA6}
  -->C:\WINDOWS\system32\\MSIEXEC.EXE /x {9541FED0-327F-4df0-8B96-EF57EF622F19}
  -->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
  -->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
  -->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
  -->C:\WINDOWS\UNRecode.exe /UNINSTALL
  -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {5A2F65A4-808F-4A1E-973E-92E17824982D}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {B3F4DC34-7F60-4B7C-A79F-1C13012D99D4}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
  2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0044-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
  32 Bit HP CIO Components Installer-->MsiExec.exe /I{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}
  ACE Mega CoDecs Pack V4.25-->C:\WINDOWS\system32\rundll32.exe setupapi,InstallHinfSection Remove_DivX 132 C:\WINDOWS\INF\ACEMCP.inf
  Adobe Acrobat 3D TryOut - English, Français, Deutsch-->msiexec /I {AC76BA86-1033-F400-8797-100000000002}
  Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
  Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
  Adobe Reader 9.1.1 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
  Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
  Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
  Assist TOSHIBA-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{12B3A009-A080-4619-9A2A-C6DB151D8D67}\Setup.exe" -l0x40c
  Assistant de connexion Windows Live-->MsiExec.exe /I{D3116CC7-24DC-4CA3-9CE1-23FED836E9F2}
  Atheros Client Utility-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{71D658CF-4E0D-4DA8-AA67-8C0B6F1C01FE}\setup.exe" -l0x40c
  Atheros Wireless LAN MiniPCI card Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{05832D65-6EDB-4D32-BA78-BCD0E2B91C02}\setup.exe" -l0x40c
  ATI - Utilitaire de désinstallation du logiciel-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
  ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
  Barre d'outils Outlook de Windows Live (Windows Live Toolbar)-->MsiExec.exe /X{4002F73D-EBB3-4EA1-A2FF-DBCB4529759E}
  BCL easyPDF Printer Driver 5.0-->MsiExec.exe /I{8D7574B1-49D7-41E6-9C2E-6B49A8619E64}
  BCL easyPDF SDK 5.1 with Form-->MsiExec.exe /I{40AED5E3-5011-48EB-BA55-FEA7FBCDE78C}
  Bloqueur de fenêtres pop-up (Windows Live Toolbar)-->MsiExec.exe /X{51F366F4-C2E4-429A-866A-59C885ED42FD}
  Boost Windows Version 2.1-->"C:\Program Files\Boost Windows\unins000.exe"
  CfgWiz-->MsiExec.exe /I{F9537757-10D8-451E-B0EB-C31C0A38C1B2}
  Color LaserJet 1600-->C:\Program Files\Zenographics\{C970B458-9E46-4CB4-9211-106681528A91}\setup.exe -u "HPCLJKCInstaller.dll=CLJ1600.INF"
  Commandes TOSHIBA-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A6690C0E-B96E-4F0F-A8EB-D5B332454AC6}\Setup.exe" -l0x40c UNINSTALL
  Comptabilité 100-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\Maestria\Uninst.isu"
  Comptabilité-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9308A8EB-1C1B-11D4-BFC8-00C04F6180C7}\setup.exe" UNINSTALL
  Correctif pour Lecteur Windows Media 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
  Correctif pour Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
  CZ-Doc2Pdf COM Demo V2.0-->"C:\Program Files\CZ-Doc2Pdf COM\unins000.exe"
  Déclaration Employeur-->C:\WINDOWS\st6unst.exe -n "C:\Déclaration_Employeur\ST6UNST.LOG"
  Détecteur de flux Windows Live Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{175B7C4A-CAF8-437A-B597-73E0D2D970FE}
  DivX Author 1.5-->C:\Program Files\DivX\DivX Author 1.5\DivXAuthorUninstall.exe /DIVX_AUTHOR
  DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
  DivX Content Uploader-->C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
  DivX Converter-->C:\Program Files\DivX\ConverterUninstall.exe /CONVERTER
  DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
  DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
  EasyPHP 1.8-->"C:\Program Files\EasyPHP1-8\unins000.exe"
  Express Rip-->C:\Program Files\NCH Swift Sound\ExpressRip\uninst.exe
  Extension de Windows Live Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{0CA6047C-D28B-4295-834A-07C52BA20C2D}
  Firebird 2.1.1.17910 (Win32)-->"C:\Program Files\Firebird\Firebird_2_1\unins000.exe"
  Foxit Reader-->C:\Program Files\Foxit Software\Foxit Reader\Uninstall.exe
  Foxit Toolbar-->"C:\Program Files\AskBarDis\unins000.exe"
  Free PDF to Word Doc Converter v1.1-->"C:\Program Files\Free PDF to Word Doc Converter\unins000.exe"
  Galerie de photos Windows Live-->MsiExec.exe /X{A70FA218-6598-4AC9-813D-63597C5DD068}
  Gestion d'énergie TOSHIBA-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\TOSHIBA\Power Saver\Uninst.isu" -c"C:\WINDOWS\system32\TPSDel.dll"
  Google Toolbar for Firefox-->MsiExec.exe /X{2CCBABCB-6427-4A55-B091-49864623C43F}
  Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
  Google Earth-->MsiExec.exe /X{CC016F21-3970-11DE-B878-005056806466}
  High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
  Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
  HP Color LaserJet CP1210 Series Toolbox-->MsiExec.exe /X{1E187923-04E5-4E1F-9BF2-40E32D93A1C4}
  HP Color LaserJet CP1210 Series-->C:\Program Files\Hewlett-Packard\HP Color LaserJet CP1210 Series\UnInstall.exe
  HP Color LaserJet CP1210 Series-->MsiExec.exe /X{54360A73-B080-4A69-BFD4-53C190DD3AB0}
  HP Customer Participation Program 8.0-->C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
  HP Deskjet 6900 series (fra)-->C:\Program Files\HP\Digital Imaging\{7ADE9F27-A175-447F-A4B4-B05FA82735E1}\setup\hpzscr01.exe -datfile hpfscr09.dat
  HP Imaging Device Functions 8.0-->C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
  hp LaserJet 4250/4350/4240-->C:\Program Files\Hewlett-Packard\hp LaserJet 4250 4350 4240\Installer\hpsetup.exe /x
  hp LaserJet 4250/4350/4240-->msiexec /x{E063B3E2-6641-4375-9F09-ADA9E589EB90}
  HP LaserJet Toolbox-->MsiExec.exe /X{FC656543-4E4C-46F8-86F0-F9F907ABE5FD}
  HP OCR Software 8.0-->C:\Program Files\HP\Digital Imaging\OCR\hpzscr01.exe -datfile hpqbud11.dat
  HP Officejet Pro All-In-One Series-->C:\Program Files\HP\Digital Imaging\{868EA922-5675-4E91-BDA6-BBD0F923C5EF}\setup\hpzscr01.exe -datfile hpwscr05.dat
  HP Photosmart Essential-->MsiExec.exe /X{EB21A812-671B-4D08-B974-2A347F0D8F70}
  HP Printer Access Tool-->MsiExec.exe /X{D8DBCF67-C44C-4768-8112-9CADBAC390E6}
  HP Product Assistant-->MsiExec.exe /I{36FDBE6E-6684-462B-AE98-9A39A1B200CC}
  HP PSC & OfficeJet 5.3.A-->"C:\Program Files\HP\Digital Imaging\{3E386744-10FA-44b2-98C9-DF7A270DECB3}\setup\hpzscr01.exe" -datfile hposcr06.dat
  HP Solution Center 8.0-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
  HP Update-->MsiExec.exe /X{FE57DE70-95DE-4B64-9266-84DA811053DB}
  HPSSupply-->MsiExec.exe /X{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}
  iFinger-->MsiExec.exe /I{AE0A983B-EF4C-4F93-ABB5-E0BD06F91917}
  Imprimantes Canon CAPT-->C:\WINDOWS\system32\Spool\Drivers\w32x86\3\CAP1UNIK.EXE
  InterVideo WinDVD Creator 2-->"C:\Program Files\InstallShield Installation Information\{2FCE4FC5-6930-40E7-A4F1-F862207424EF}\setup.exe" REMOVEALL
  InterVideo WinDVD for TOSHIBA-->"C:\Program Files\InstallShield Installation Information\{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}\setup.exe" REMOVEALL
  J2SE Runtime Environment 5.0 Update 4-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150040}
  Kaspersky Internet Security 2009-->MsiExec.exe /I{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}
  Kaspersky Internet Security 2009-->MsiExec.exe /I{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}
  Kyodai Mahjongg 2006 v1.0-->"C:\Program Files\Kyodai Mahjongg 2006\unins000.exe"
  LiceneManager-->MsiExec.exe /I{6EB0AA0F-19B8-4947-B4D8-A92C465E0292}
  Macromedia Dreamweaver MX-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8B4AB829-DFD3-436D-B808-D9733D76C590}\Setup.exe" -l0x9 mmUninstall
  Macromedia Fireworks MX-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{930B2432-43D4-11D5-9871-00C04F8EEB39}\Setup.exe" -l0x9 UNINSTALL
  Macromedia Flash MX-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3BE480ED-E17A-431A-981C-5C2EDDBCD3BF}\Setup.exe" -l0x9 UNINSTALL
  Macromedia Flash Player-->MsiExec.exe /X{0456ebd7-5f67-4ab6-852e-63781e3f389c}
  Manuels TOSHIBA-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3EB6332B-AF02-457C-A31C-835458C5B48B}\setup.exe" -l0x40c -removeonly
  Menus intelligents (Windows Live Toolbar)-->MsiExec.exe /X{0CC70FEF-5068-4CD5-B4DE-86FFD98EC929}
  Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
  Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
  Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
  Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
  Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
  Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
  Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
  Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
  Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
  Microsoft Office Language Pack 2007 Service Pack 1 (SP1)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {EC50B538-CBE1-42E6-B7FE-87AA540AADFB}
  Microsoft Office OneNote 2003-->MsiExec.exe /I{91A1040C-6000-11D3-8CFE-0150048383C9}
  Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
  Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
  Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
  Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
  Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
  Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
  Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
  Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
  Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
  Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
  Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
  Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
  Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
  Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
  Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
  Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
  Mise à jour critique pour Lecteur Windows Media 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Lecteur Windows Media (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Lecteur Windows Media 10 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Lecteur Windows Media 10 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Lecteur Windows Media 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Lecteur Windows Media 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Step by Step Interactive Training (KB898458)-->"C:\WINDOWS\$NtUninstallKB898458$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Step by Step Interactive Training (KB923723)-->"C:\WINDOWS\$NtUninstallKB923723$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB960714)-->"C:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
  Mise à jour de sécurité pour Windows XP (KB963027)-->"C:\WINDOWS\$NtUninstallKB963027$\spuninst\spuninst.exe"
  Mise à jour pour Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
  Mise à jour pour Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
  Mise à jour pour Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
  Mise à jour pour Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
  Mozilla Firefox (3.0.1)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
  MPM-->MsiExec.exe /X{8F968232-15C6-4872-84C2-9FCDAA1AEAB6}
  MrvlUsgTracking-->MsiExec.exe /I{DDC87CB0-CB02-4454-9B05-EE09CB9D035D}
  MSI to redistribute MS VS2005 CRT libraries-->MsiExec.exe /I{A8D93648-9F7F-407D-915C-62044644C3DA}
  MSN-->C:\Program Files\MSN\MsnInstaller\msninst.exe /Action:ARP
  MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
  MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
  MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
  Navigation par onglets (Windows Live Toolbar)-->MsiExec.exe /X{E74559C2-BB47-45AD-83DD-0D66B67E7811}
  Nero 7 Essentials-->MsiExec.exe /I{F17F7703-1E72-40C1-A0DD-E5B365661036}
  neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
  NET Installation Assistance for VB6 App (Runtime Only)-->MsiExec.exe /I{66333C41-085E-4DA1-8273-E2BCA382D766}
  Nokia Connectivity Cable Driver-->MsiExec.exe /X{6882DD11-33B8-4DEA-8305-7E765BF74BD3}
  Nokia PC Connectivity Solution-->MsiExec.exe /I{0D80391C-0A72-43BB-9BC2-143F63CC111D}
  Nokia PC Suite-->MsiExec.exe /I{531317A5-586A-4E36-87C1-CA823447B375}
  OneCare Advisor (Windows Live Toolbar)-->MsiExec.exe /X{6D7F8D4B-D1A4-402A-973E-31E90940E585}
  Outil de diagnostic PC TOSHIBA-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\TOSHIBA\PCDiag\Uninst.isu"
  Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
  Panneau de contrôle ATI-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0BEDBD4E-2D34-47B5-9973-57E62B29307C}\setup.exe"
  PIF installer-->MsiExec.exe /I{2DC169BB-FD26-4EB1-AED8-5CDA2D08849F}
  Power MP3 WAV Converter 1.11-->"C:\Program Files\Sagasoft\Power MP3 WAV Converter\unins000.exe"
  Power Video to Audio Converter 1.03-->"C:\Program Files\Sagasoft\Power Video to Audio Converter\unins000.exe"
  Prism Video Converter-->C:\Program Files\NCH Software\Prism\uninst.exe
  RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
  REALTEK Gigabit and Fast Ethernet NIC Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{94FB906A-CF42-4128-A509-D353026A607E}\Setup.exe" -l0x40c REMOVE
  Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x40c -removeonly
  Réducteur de bruit lect. CD/DVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}\Setup.exe" -l0x40c
  Samsung Master-->C:\Program Files\InstallShield Installation Information\{AEC0CEBC-0FC7-4716-8222-1C4A742719B1}\Setup.exe -runfromtemp -l0x040c -removeonly
  Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
  Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
  Security Update for 2007 Microsoft Office System (KB958439)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {6491B8AA-D11C-4648-A461-6234B31EB7E2}
  Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
  Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
  Security Update for Microsoft Office Excel 2007 (KB958437)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {648FC016-2D6B-4A16-8D87-404533642F4B}
  Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
  Security Update for Microsoft Office Publisher 2007 (KB950114)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85}
  Security Update for Microsoft Office system 2007 (KB954326)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5F7F6FFF-395D-480E-8450-64F385D82C5F}
  Security Update for Microsoft Office system 2007 (KB956828)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {885E081B-72BD-4E76-8E98-30B4BE468FAC}
  Security Update for Microsoft Office Word 2007 (KB956358)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {4551666D-0FD6-4C69-8A81-1C6F2E64517C}
  Skype™ 3.6-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
  Son virtuel TOSHIBA-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8B12BA86-ADAC-4BA6-B441-FFC591087252}\Setup.exe" /uninstall
  Sonic DLA-->MsiExec.exe /I{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}
  Sonic RecordNow!-->MsiExec.exe /I{9541FED0-327F-4DF0-8B96-EF57EF622F19}
  SoundTap Streaming Audio Recorder-->C:\Program Files\NCH Swift Sound\SoundTap\uninst.exe
  Spyware+ Component-->MsiExec.exe /I{8CF6B25D-AC71-42fb-9E2F-877DF855B605}
  Surligneur (Windows Live Toolbar)-->MsiExec.exe /X{81B5F83F-2291-48B0-8375-36B63A9BF5B0}
  Switch Sound File Converter-->C:\Program Files\NCH Swift Sound\Switch\uninst.exe
  SymCUW-->MsiExec.exe /I{4E1365FE-A878-4C3A-B055-220B8688FC09}
  Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
  TOSHIBA ConfigFree-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}\setup.exe" -l0x40c UNINSTALL
  TOSHIBA Hotkey Utility-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{64DD71BC-3109-4C88-9AD3-D5422644B722}\setup.exe" -l0x40c
  TOSHIBA Software Modem-->Tosmreg -U
  TOSHIBA TouchPad ON/Off Utility-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{69BE47C2-36FE-4397-8199-85D8EAE69982}\setup.exe" -l0x40c
  TOSHIBA Utilities-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{78C68CB9-3DF5-44F3-AB9D-FA305C5EB85C}\setup.exe" -l0x40c
  Touch and Launch-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5D96E2B1-D9AC-46E0-9073-425C5F63E338}\setup.exe"
  Uniblue RegistryBooster 2009-->"C:\Documents and Settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}\Uniblue RegistryBooster.exe" REMOVE=TRUE MODIFY=FALSE
  Uniblue RegistryBooster 2009-->C:\Documents and Settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}\Uniblue RegistryBooster.exe
  Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
  Update for Microsoft Office Outlook 2007 (KB952142)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {4AD3A076-427C-491F-A5B7-7D1DE788A756}
  Update for Outlook 2007 Junk Email Filter (kb968503)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5DD98950-4D10-4B79-8BF6-59726705207D}
  Utilitaire de zoom TOSHIBA-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{64212898-097F-4F3F-AECA-6D34A7EF82DF}\Setup.exe" -l0x40c
  VCRedistSetup-->MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
  VideoLAN VLC media player 0.8.5-->C:\Program Files\VideoLAN\VLC\uninstall.exe
  WavePad Sound Editor-->C:\Program Files\NCH Swift Sound\WavePad\uninst.exe
  Windows Driver Package - Nokia Modem (06/12/2006 6.81.0.21)-->C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokbtmdm_62A340731F8930057B44B8864F236850B0D49D65\nokbtmdm.inf
  Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
  Windows Live Favorites pour Windows Live Toolbar-->MsiExec.exe /X{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}
  Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
  Windows Live Mail-->MsiExec.exe /I{C514C594-23AA-4F13-A070-DB8BDB27594F}
  Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
  Windows Live Toolbar-->"C:\Program Files\Windows Live Toolbar\UnInstall.exe" {0A8C97AD-DEED-4894-B446-3ABA95A77D0D}
  Windows Live Toolbar-->MsiExec.exe /X{0A8C97AD-DEED-4894-B446-3ABA95A77D0D}
  Windows Live Writer-->MsiExec.exe /X{3DFF4274-EBB0-4356-9692-972965018954}
  Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
  Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
  Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
  WinZip 11.1-->MsiExec.exe /X{CD95F661-A5C4-44F5-A6AA-ECDD91C240B5}
  Yahoo! Toolbar avec bloqueur de fenêtres pop-up-->C:\PROGRA~1\Yahoo!\Common\unyt.exe
  
  ======Hosts File======
  
  66.98.148.65 auto.search.msn.com
  66.98.148.65 auto.search.msn.es
  
  ======Security center information======
  
  AV: Kaspersky Internet Security (disabled)
  FW: Kaspersky Internet Security (disabled)
  
  ======System event log======
  
  Computer Name: ARFAOUI
  Event Code: 7011
  Message: Délai (30000 millisecondes) d'attente pour une réponse du service Spooler à une transaction.
  
  Record Number: 4312
  Source Name: Service Control Manager
  Time Written: 20090523221000.000000+060
  Event Type: erreur
  User:
  
  Computer Name: ARFAOUI
  Event Code: 11
  Message: Le pilote a détecté une erreur du contrôleur sur \Device\CdRom0.
  
  Record Number: 4311
  Source Name: Cdrom
  Time Written: 20090523220910.000000+060
  Event Type: erreur
  User:
  
  Computer Name: ARFAOUI
  Event Code: 11
  Message: Le pilote a détecté une erreur du contrôleur sur \Device\CdRom0.
  
  Record Number: 4310
  Source Name: Cdrom
  Time Written: 20090523220910.000000+060
  Event Type: erreur
  User:
  
  Computer Name: ARFAOUI
  Event Code: 11
  Message: Le pilote a détecté une erreur du contrôleur sur \Device\CdRom0.
  
  Record Number: 4309
  Source Name: Cdrom
  Time Written: 20090523220910.000000+060
  Event Type: erreur
  User:
  
  Computer Name: ARFAOUI
  Event Code: 11
  Message: Le pilote a détecté une erreur du contrôleur sur \Device\CdRom0.
  
  Record Number: 4308
  Source Name: Cdrom
  Time Written: 20090523220910.000000+060
  Event Type: erreur
  User:
  
  =====Application event log=====
  
  Computer Name: ARFAOUI
  Event Code: 0
  Message:
  Record Number: 1805
  Source Name: hpqcxs08
  Time Written: 20090316090151.000000+060
  Event Type: Informations
  User:
  
  Computer Name: ARFAOUI
  Event Code: 251
  Message:
  Record Number: 1804
  Source Name: FirebirdGuardianDefaultInstance
  Time Written: 20090316090150.000000+060
  Event Type: Informations
  User:
  
  Computer Name: ARFAOUI
  Event Code: 1000
  Message: Application défaillante spoolsv.exe, version 5.1.2600.5512, module défaillant CP1215LM.DLL, version 5.57.18.39, adresse de défaillance 0x00008bc3.
  
  Record Number: 1803
  Source Name: Application Error
  Time Written: 20090316085750.000000+060
  Event Type: erreur
  User:
  
  Computer Name: ARFAOUI
  Event Code: 1800
  Message: Le service Centre de sécurité Windows a démarré.
  
  Record Number: 1802
  Source Name: SecurityCenter
  Time Written: 20090316085735.000000+060
  Event Type: Informations
  User:
  
  Computer Name: ARFAOUI
  Event Code: 0
  Message:
  Record Number: 1801
  Source Name: hpqddsvc
  Time Written: 20090316085641.000000+060
  Event Type: Informations
  User:
  
  ======Environment variables======
  
  "ComSpec"=%SystemRoot%\system32\cmd.exe
  "Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\ATI Technologies\ATI Control Panel
  "windir"=%SystemRoot%
  "FP_NO_HOST_CHECK"=NO
  "OS"=Windows_NT
  "PROCESSOR_ARCHITECTURE"=x86
  "PROCESSOR_LEVEL"=6
  "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 13 Stepping 8, GenuineIntel
  "PROCESSOR_REVISION"=0d08
  "NUMBER_OF_PROCESSORS"=1
  "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
  "TEMP"=%SystemRoot%\TEMP
  "TMP"=%SystemRoot%\TEMP
  
  -----------------EOF-----------------
  
  0
  
  Réagir
3. monstre
  
  Logfile of random's system information tool 1.06 (written by random/random)
  Run by toshiba at 2009-06-08 00:37:18
  Microsoft Windows XP Édition familiale Service Pack 3
  System drive C: has 18 GB (24%) free of 76 GB
  Total RAM: 446 MB (36% free)
  
  HijackThis download failed
  
  ======Scheduled tasks folder======
  
  C:\WINDOWS\tasks\1-Click Maintenance.job
  C:\WINDOWS\tasks\AppleSoftwareUpdate.job
  C:\WINDOWS\tasks\Google Software Updater.job
  C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job
  C:\WINDOWS\tasks\Vérifier les mises à jour de Windows Live Toolbar.job
  
  ======Registry dump======
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}]
  Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 440384]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
  Adobe PDF Link Helper - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
  AskBar BHO - C:\Program Files\AskBarDis\bar\bin\askBar.dll [2008-11-18 333192]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
  Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2008-04-03 1372160]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
  RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2009-05-04 312928]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}]
  IEVkbdBHO Class - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll [2008-07-29 62728]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
  DriveLetterAccess - C:\WINDOWS\System32\DLA\DLASHX_W.DLL [2005-08-01 110652]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
  Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
  Adobe PDF Conversion Toolbar Helper - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2005-09-23 231160]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
  Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-05-19 668656]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
  Windows Live Toolbar Helper - C:\Program Files\Windows Live Toolbar\msntb.dll [2007-10-19 546320]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
  {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Windows Live Toolbar - C:\Program Files\Windows Live Toolbar\msntb.dll [2007-10-19 546320]
  {47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2005-09-23 231160]
  {3041d03e-fd4b-44e0-b742-2d9b88305f98} - Foxit Toolbar - C:\Program Files\AskBarDis\bar\bin\askBar.dll [2008-11-18 333192]
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
  "Tvs"=C:\Program Files\TOSHIBA\Tvs\TvsTray.exe [2005-11-30 73728]
  "THotkey"=C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe [2005-12-08 352256]
  "SynTPLpr"=C:\Program Files\Synaptics\SynTP\SynTPLpr.exe [2004-10-14 98394]
  "SynTPEnh"=C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2004-10-14 688218]
  "LtMoh"=C:\Program Files\ltmoh\Ltmoh.exe [2005-05-19 188416]
  "DLA"=C:\WINDOWS\System32\DLA\DLACTRLW.EXE [2005-08-01 122940]
  "ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2005-08-05 344064]
  "AGRSMMSG"=C:\WINDOWS\AGRSMMSG.exe [2005-10-15 88203]
  ""= []
  "HPUsageTracking"=C:\Program Files\HP\HP UT\bin\hppusg.exe [2007-11-02 36864]
  "PrnStatusMX"=C:\Program Files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe [2007-07-13 1077248]
  "TkBellExe"=C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [2009-05-04 198160]
  "Adobe Reader Speed Launcher"=C:\Program Files\Reader\Reader_sl.exe [2009-02-27 35696]
  "AVP"=C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-05-24 206088]
  
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
  "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
  "TOSCDSPD"=C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe [2005-04-11 65536]
  "MSMSGS"=C:\Program Files\Messenger\msmsgs.exe [2008-04-13 1695232]
  "swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-05-19 39408]
  "nvd32_r"=C:\Documents and Settings\toshiba\Application Data\unobi.dll [2009-05-20 35840]
  "DiskChk help"=C:\Documents and Settings\All Users\proto.dll [2009-05-31 26624]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
  []
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeUpdater]
  C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe []
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-12-11 49152]
  
  [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
  C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe [2006-01-12 155648]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
  "AppInit_DLLS"="acaptuser32.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll"
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
  C:\WINDOWS\system32\klogon.dll [2008-07-29 218376]
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
  WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
  
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
  "DisableTaskMgr"=0
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
  "DisableTaskMgr"=0
  
  [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
  "NoDrives"=0
  "NoDriveTypeAutoRun"=145
  "NoFolderOptions"=0
  "NoFind"=0
  "NoRun"=0
  
  [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
  "NoDriveTypeAutoRun"=
  "NoDrives"=
  "NoDriveAutoRun"=
  "NoFolderOptions"=
  "HonorAutoRunSetting"=
  
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
  "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
  "C:\Program Files\Macromedia\Fireworks MX\Fireworks.exe"="C:\Program Files\Macromedia\Fireworks MX\Fireworks.exe:*:Disabled:Fireworks MX"
  "C:\Program Files\EasyPHP\mysql\bin\mysqld-nt.exe"="C:\Program Files\EasyPHP\mysql\bin\mysqld-nt.exe:*:Disabled:mysqld-nt"
  "C:\Program Files\EasyPHP\apache\Apache.exe"="C:\Program Files\EasyPHP\apache\Apache.exe:*:Disabled:Apache"
  "C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe"="C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe:*:Disabled:Dreamweaver MX"
  "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
  "C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.325\French\setup.exe"="C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.325\French\setup.exe:*:Enabled:Programme d'installation de Kaspersky Internet Security 7.0"
  "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
  "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
  "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
  "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe"
  "C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe"
  "C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe"
  "C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe"
  "C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe"
  "C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe"
  "C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe"
  "C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe"
  "C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe"
  "C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe"
  "C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe"
  "C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe"
  "C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe"
  "C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe"
  "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
  "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
  "C:\Program Files\Free Download Manager\fdm.exe"="C:\Program Files\Free Download Manager\fdm.exe:*:Enabled:Free Download Manager"
  "C:\Documents and Settings\toshiba\Local Settings\Temp\IXP000.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe"="C:\Documents and Settings\toshiba\Local Settings\Temp\IXP000.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe:*:Enabled:C:\DOCUME~1\toshiba\LOCALS~1\Temp\IXP000.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe"
  "C:\Documents and Settings\toshiba\Local Settings\Temp\IXP001.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe"="C:\Documents and Settings\toshiba\Local Settings\Temp\IXP001.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe:*:Enabled:C:\DOCUME~1\toshiba\LOCALS~1\Temp\IXP001.TMP\Kaspersky Internet Security 2009 + Life Time Serial Key.exe"
  "C:\WINDOWS\system32\winudp64.exe"="C:\WINDOWS\system32\winudp64.exe:*:Disabled:winudp64"
  
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
  "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
  "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
  "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
  "C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
  
  [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{de9c7c41-2871-11de-afc6-0011f5ef0573}]
  shell\AutoRun\command - RECYCLER\help.exe
  shell\opEN\command - RECYCLER\help.exe
  
  ======File associations======
  
  .js - open - "C:\Program Files\Macromedia\Dreamweaver MX\Dreamweaver.exe" "%1"
  
  ======List of files/folders created in the last 1 months======
  
  2009-06-08 00:37:23 ----D---- C:\Program Files\trend micro
  2009-06-08 00:37:18 ----D---- C:\rsit
  2009-05-31 17:58:05 ----A---- C:\WINDOWS\pxinstall_log.txt
  2009-05-31 17:41:42 ----A---- C:\ibvdq.exe
  2009-05-31 17:40:28 ----A---- C:\orves.exe
  2009-05-31 17:40:02 ----A---- C:\karg.exe
  2009-05-31 02:42:22 ----A---- C:\WINDOWS\system32\win.txt
  2009-05-31 02:42:22 ----A---- C:\WINDOWS\system32\2.txt
  2009-05-31 02:42:22 ----A---- C:\WINDOWS\system32\1.txt
  2009-05-31 02:17:17 ----D---- C:\Program Files\Hotspot Shield
  2009-05-30 20:51:30 ----D---- C:\Documents and Settings\toshiba\Application Data\Boost Windows
  2009-05-30 20:51:07 ----D---- C:\Program Files\Boost Windows
  2009-05-30 15:04:09 ----D---- C:\Documents and Settings\toshiba\Application Data\NCH Software
  2009-05-29 03:06:39 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
  2009-05-29 03:06:31 ----HDC---- C:\WINDOWS\$NtUninstallKB961373$
  2009-05-29 03:05:59 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
  2009-05-29 03:05:31 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
  2009-05-29 03:05:14 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
  2009-05-29 03:04:00 ----HDC---- C:\WINDOWS\$NtUninstallKB960715$
  2009-05-29 03:02:39 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
  2009-05-29 03:02:30 ----HDC---- C:\WINDOWS\$NtUninstallKB958690$
  2009-05-29 03:02:15 ----HDC---- C:\WINDOWS\$NtUninstallKB959772_WM11$
  2009-05-27 23:52:25 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
  2009-05-26 06:30:40 ----HDC---- C:\WINDOWS\$NtUninstallKB963027$
  2009-05-24 19:28:55 ----D---- C:\Program Files\Kaspersky Lab
  2009-05-24 11:51:54 ----D---- C:\Program Files\KAZAA
  2009-05-24 11:51:54 ----D---- C:\My Downloads
  2009-05-23 11:00:30 ----D---- C:\Program Files\Esl
  2009-05-23 10:59:45 ----D---- C:\Program Files\Resource
  2009-05-23 10:59:44 ----D---- C:\Program Files\Setup Files
  2009-05-23 10:59:44 ----D---- C:\Program Files\Reader
  2009-05-22 21:29:11 ----A---- C:\Documents and Settings\toshiba\Application Data\unobi.dll
  2009-05-20 23:38:58 ----D---- C:\b0bbdf5af1c95e7967
  2009-05-20 08:59:24 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
  2009-05-19 21:11:15 ----D---- C:\Program Files\Apple Software Update
  2009-05-19 21:11:15 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
  2009-05-19 14:31:09 ----D---- C:\Program Files\WinZip
  2009-05-19 13:24:34 ----D---- C:\98f07633941d0b5a64
  2009-05-19 12:47:04 ----HDC---- C:\Documents and Settings\All Users\Application Data\{51019853-129C-4EDE-9030-D5FD7BBD9AD0}
  2009-05-19 12:06:56 ----D---- C:\cc5dd750a86c1436d5e77e9d2e
  2009-05-19 12:05:04 ----RHD---- C:\AHCache
  2009-05-19 00:16:54 ----D---- C:\Documents and Settings\All Users\Application Data\Google Updater
  2009-05-16 22:57:00 ----D---- C:\Program Files\NCH Swift Sound
  2009-05-16 22:45:52 ----D---- C:\Program Files\Sagasoft
  2009-05-16 01:33:36 ----D---- C:\Documents and Settings\toshiba\Application Data\Uniblue
  2009-05-16 01:33:11 ----D---- C:\Program Files\Uniblue
  2009-05-16 01:20:21 ----HDC---- C:\Documents and Settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}
  2009-05-14 14:56:41 ----D---- C:\Program Files\AskBarDis
  2009-05-14 14:56:33 ----D---- C:\Program Files\Foxit Software
  2009-05-14 14:56:33 ----D---- C:\Documents and Settings\toshiba\Application Data\Foxit
  2009-05-11 15:09:15 ----D---- C:\Program Files\Fichiers communs\Windows Live
  2009-05-09 00:12:51 ----D---- C:\Program Files\DAMN NFO Viewer
  
  ======List of files/folders modified in the last 1 months======
  
  2009-06-08 00:37:23 ----D---- C:\Program Files
  2009-06-08 00:37:12 ----D---- C:\WINDOWS\Prefetch
  2009-06-08 00:29:29 ----D---- C:\WINDOWS\system32
  2009-06-07 23:39:55 ----D---- C:\WINDOWS\temp
  2009-06-07 23:27:21 ----D---- C:\Program Files\Mozilla Firefox
  2009-06-07 23:03:30 ----D---- C:\WINDOWS\system32\drivers
  2009-06-07 22:48:27 ----D---- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
  2009-06-07 22:47:48 ----D---- C:\WINDOWS\system32\ias
  2009-06-07 22:46:18 ----SD---- C:\WINDOWS\Tasks
  2009-06-07 11:42:06 ----D---- C:\WINDOWS
  2009-06-07 11:39:15 ----HD---- C:\Config.Msi
  2009-06-07 11:38:34 ----A---- C:\WINDOWS\SchedLgU.Txt
  2009-06-07 11:12:04 ----SHD---- C:\WINDOWS\Installer
  2009-06-07 11:11:18 ----D---- C:\WINDOWS\system32\CatRoot
  2009-06-07 11:09:49 ----HD---- C:\WINDOWS\inf
  2009-06-07 00:56:38 ----A---- C:\WINDOWS\NeroDigital.ini
  2009-06-07 00:55:50 ----D---- C:\WINDOWS\system32\CatRoot2
  2009-06-07 00:15:53 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
  2009-06-04 20:21:14 ----D---- C:\Documents and Settings\toshiba\Application Data\uTorrent
  2009-06-01 02:33:38 ----A---- C:\WINDOWS\system.ini
  2009-05-31 02:12:30 ----D---- C:\Documents and Settings
  2009-05-31 00:31:23 ----A---- C:\WINDOWS\wininit.ini
  2009-05-30 20:59:56 ----D---- C:\Program Files\Maestria
  2009-05-30 20:59:56 ----D---- C:\Program Files\ActDrv100
  2009-05-30 20:59:55 ----D---- C:\WINDOWS\system32\NtmsData
  2009-05-30 20:59:55 ----D---- C:\WINDOWS\system32\config
  2009-05-30 20:59:55 ----D---- C:\WINDOWS\repair
  2009-05-30 20:59:55 ----D---- C:\WINDOWS\Help
  2009-05-30 00:48:00 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
  2009-05-30 00:45:42 ----D---- C:\Documents and Settings\toshiba\Application Data\NCH Swift Sound
  2009-05-29 03:35:21 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
  2009-05-29 03:29:42 ----D---- C:\WINDOWS\system32\wbem
  2009-05-29 03:29:41 ----D---- C:\WINDOWS\AppPatch
  2009-05-29 03:06:42 ----RSHDC---- C:\WINDOWS\system32\dllcache
  2009-05-29 03:06:23 ----D---- C:\Program Files\Fichiers communs\Microsoft Shared
  2009-05-29 03:05:26 ----HD---- C:\WINDOWS\$hf_mig$
  2009-05-29 03:05:01 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
  2009-05-29 03:04:38 ----RSD---- C:\WINDOWS\assembly
  2009-05-29 03:02:25 ----D---- C:\Program Files\Windows Media Player
  2009-05-23 11:00:25 ----D---- C:\Program Files\Fichiers communs\Adobe
  2009-05-22 23:19:56 ----D---- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
  2009-05-22 21:29:25 ----SHD---- C:\RECYCLER
  2009-05-20 23:25:37 ----D---- C:\Program Files\Google
  2009-05-20 23:09:35 ----D---- C:\Program Files\Fichiers communs\Wise Installation Wizard
  2009-05-20 22:42:53 ----D---- C:\WINDOWS\Registration
  2009-05-20 20:02:57 ----D---- C:\WINDOWS\SoftwareDistribution
  2009-05-20 11:52:31 ----A---- C:\WINDOWS\powervideotoaudio.ini
  2009-05-20 11:50:09 ----A---- C:\WINDOWS\m3jpeg.ini
  2009-05-20 09:09:58 ----D---- C:\WINDOWS\Microsoft.NET
  2009-05-19 22:52:40 ----HD---- C:\Program Files\InstallShield Installation Information
  2009-05-19 22:52:36 ----D---- C:\Documents and Settings\toshiba\Application Data\COWON
  2009-05-19 22:52:27 ----D---- C:\Program Files\Fichiers communs
  2009-05-19 21:09:42 ----D---- C:\Documents and Settings\toshiba\Application Data\Nokia Multimedia Player
  2009-05-19 14:32:35 ----D---- C:\Documents and Settings\All Users\Application Data\WinZip
  2009-05-19 13:21:36 ----D---- C:\WINDOWS\WinSxS
  2009-05-19 00:33:30 ----D---- C:\Documents and Settings\toshiba\Application Data\Google
  2009-05-17 22:18:26 ----D---- C:\Program Files\Adobe
  2009-05-16 23:56:47 ----D---- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound
  2009-05-16 23:09:17 ----D---- C:\Program Files\NCH Software
  2009-05-16 22:47:42 ----A---- C:\WINDOWS\powermp3wavconverter.ini
  2009-05-12 23:55:52 ----D---- C:\WINDOWS\network diagnostic
  2009-05-12 14:04:52 ----D---- C:\Program Files\Free Download Manager
  2009-05-12 13:56:40 ----A---- C:\WINDOWS\CD_SearchHistory.INI
  2009-05-12 00:45:38 ----D---- C:\WINDOWS\system32\Lang
  2009-05-11 15:09:13 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
  2009-05-10 02:30:42 ----D---- C:\Downloads
  2009-05-09 19:32:57 ----D---- C:\Program Files\eMule
  
  ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
  
  R1 DLACDBHM;DLACDBHM; C:\WINDOWS\System32\Drivers\DLACDBHM.SYS [2005-07-07 5628]
  R1 DLARTL_N;DLARTL_N; C:\WINDOWS\System32\Drivers\DLARTL_N.SYS [2005-07-07 22684]
  R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-13 40576]
  R1 KLIF;Kaspersky Lab Driver; C:\WINDOWS\system32\DRIVERS\klif.sys [2009-05-24 213520]
  R1 WS2IFSL;Environnement de prise en charge de Fournisseur de services non-IFS Windows Sockets 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2004-08-05 12032]
  R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.2.0.3; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2006-05-30 17801]
  R2 DLABOIOM;DLABOIOM; C:\WINDOWS\System32\DLA\DLABOIOM.SYS [2005-08-01 25628]
  R2 DLADResN;DLADResN; C:\WINDOWS\System32\DLA\DLADResN.SYS [2005-08-01 2496]
  R2 DLAIFS_M;DLAIFS_M; C:\WINDOWS\System32\DLA\DLAIFS_M.SYS [2005-08-01 86524]
  R2 DLAOPIOM;DLAOPIOM; C:\WINDOWS\System32\DLA\DLAOPIOM.SYS [2005-08-01 14684]
  R2 DLAPoolM;DLAPoolM; C:\WINDOWS\System32\DLA\DLAPoolM.SYS [2005-08-01 6364]
  R2 DLAUDF_M;DLAUDF_M; C:\WINDOWS\System32\DLA\DLAUDF_M.SYS [2005-08-01 87004]
  R2 DLAUDFAM;DLAUDFAM; C:\WINDOWS\System32\DLA\DLAUDFAM.SYS [2005-08-01 92700]
  R2 DRVNDDM;DRVNDDM; C:\WINDOWS\System32\Drivers\DRVNDDM.SYS [2005-07-07 40544]
  R2 Netdevio;TOSHIBA Network Device Usermode I/O Protocol; C:\WINDOWS\system32\DRIVERS\netdevio.sys [2003-01-29 12032]
  R3 AgereSoftModem;TOSHIBA V92 Software Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2005-11-15 1122656]
  R3 AR5211;Atheros Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ar5211.sys [2005-09-12 468736]
  R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
  R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2005-08-04 1273344]
  R3 CmBatt;Pilote pour Batterie à méthode de contrôle ACPI Microsoft; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]
  R3 HDAudBus;Pilote de bus Microsoft UAA pour High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
  R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2005-11-11 4064256]
  R3 Iviaspi;IVI ASPI Shell; C:\WINDOWS\system32\drivers\iviaspi.sys [2003-09-10 21060]
  R3 KLFLTDEV;Kaspersky Lab KLFltDev; C:\WINDOWS\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]
  R3 NCHSSVAD;SoundTap Recorder; C:\WINDOWS\system32\drivers\nchssvad.sys [2009-05-16 27136]
  R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
  R3 Pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2003-09-19 10368]
  R3 RTL8023xp;Realtek 10/100/1000 NIC Family all in one NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys [2005-03-04 74496]
  R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2004-10-14 185728]
  R3 TVALD;Toshiba Mobile PC Service; C:\WINDOWS\system32\DRIVERS\NBSMI.sys [2005-10-20 6144]
  R3 Tvs;TOSHIBA Virtual Sound with SRS technologies; C:\WINDOWS\system32\DRIVERS\Tvs.sys [2005-11-30 43392]
  R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
  R3 usbhub;Pilote de concentrateur standard USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
  R3 usbohci;Pilote miniport de contrôleur hôte ouvert USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
  S1 ASPI32;ASPI32; C:\WINDOWS\system32\drivers\ASPI32.sys []
  S1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-13 14720]
  S2 RapidPort;RapidPort; \??\C:\WINDOWS\system32\Drivers\CAPLPTN.SYS []
  S3 AVPsys;AVPsys; \??\C:\WINDOWS\system32\drivers\tdi.sys []
  S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
  S3 HidUsb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
  S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2007-07-05 49920]
  S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2007-07-05 16496]
  S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2007-07-05 21568]
  S3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2008-04-30 24592]
  S3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
  S3 Nokia USB Generic;Nokia USB Generic; C:\WINDOWS\system32\drivers\nmwcdc.sys [2006-05-29 8704]
  S3 Nokia USB Modem;Nokia USB Modem; C:\WINDOWS\system32\drivers\nmwcdcm.sys [2006-05-29 13312]
  S3 Nokia USB Phone Parent;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\nmwcd.sys [2006-05-29 127488]
  S3 rtl8139;Pilote NT de carte Realtek PCI Fast Ethernet à base RTL8139(A/B/C); C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
  S3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
  S3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
  S3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
  S3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
  S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
  S3 zmNTZip;zmNTZip; \??\C:\Program Files\ZipMagic\zmNTZip.sys []
  S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
  
  ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
  
  R2 ACS;Service de configuration Atheros; C:\WINDOWS\system32\acs.exe [2005-07-07 36864]
  R2 Adobe LM Service;Adobe LM Service; C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe [2007-12-03 69632]
  R2 astcc;AST Service; C:\WINDOWS\system32\AstSrv.exe [2007-06-20 53248]
  R2 CFSvcs;ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [2005-01-18 40960]
  R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance; C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe [2008-06-13 81920]
  R2 hpqddsvc;Service HP CUE DeviceDiscovery; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
  R2 MDM;Machine Debug Manager; C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
  R2 Net Driver HPZ12;Net Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
  R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-13 14336]
  R2 TAPPSRV;TOSHIBA Application Service; C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe [2005-08-10 35328]
  R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance; C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe [2008-06-13 2723840]
  R3 hpqcxs08;hpqcxs08; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
  S2 AVP;Kaspersky Internet Security; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe [2009-05-24 206088]
  S2 gupdate1c9d80fecd7376a;Service Google Update (gupdate1c9d80fecd7376a); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-05-19 133104]
  S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-05-19 183280]
  S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
  S3 bepldr;BCL easyPDF SDK 5 Loader; C:\Program Files\Fichiers communs\BCL Technologies\easyPDF 5\bepldr.exe [2008-02-07 151552]
  S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
  S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
  S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
  S3 ServiceLayer;ServiceLayer; C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe [2006-06-05 174080]
  S3 usnjsvc;Service Messenger Sharing Folders USN Journal Reader; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
  S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
  S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe []
  S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
  
  -----------------EOF-----------------
  
  0
  
  Réagir

Win 32 magania

10 réponses

Discussions similaires

Newsletters