Rapport hijackthis

Je tente un scan complet avec malwarebyte

Voilà je viens de reprendre le travail sur cet ordi.

Voilà le rapport combofix que j'ai fait avec avast désactivé

ComboFix 09-07-14.08 - Joëlle 17/07/2009 17:51.2.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Basique 6.0.6001.1.1252.33.1036.18.2047.1248 [GMT 2:00]
Running from: s:\docs joëlle\Bureau\avril.exe
AV: avast! antivirus 4.8.1229 [VPS 081124-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: avast! antivirus 4.8.1229 [VPS 081124-0] *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Search Settings
c:\program files\Search Settings\kb125\res\ErrorPageTemplate.css
c:\program files\Search Settings\kb125\res\help.gif
c:\program files\Search Settings\kb125\res\pixel.gif
c:\program files\Search Settings\kb125\res\tab_icon.png
c:\program files\Search Settings\kb125\res\tabdata.js
c:\program files\Search Settings\kb125\res\tablib.js
c:\program files\Search Settings\kb125\res\tabwelcome_en.html
c:\program files\Search Settings\kb125\res\toolbar_background.gif
c:\program files\Search Settings\kb125\res\vista_directions.png
c:\program files\Search Settings\kb125\res\xp_directions.png
c:\program files\Search Settings\kb125\res\yahoo_search.gif
c:\program files\Search Settings\kb125\SearchSettings.dll
c:\program files\Search Settings\SearchSettings.exe
c:\windows\Installer\30015.msi
c:\windows\Installer\3eb17a.msi

.
((((((((((((((((((((((((( Files Created from 2009-06-17 to 2009-07-17 )))))))))))))))))))))))))))))))
.

2009-07-17 15:59 . 2009-07-17 15:59 -------- d-----w- c:\users\LogMeInRemoteUser\AppData\Local\temp
2009-07-17 15:59 . 2009-07-17 15:59 -------- d-----w- c:\users\Guillaume\AppData\Local\temp
2009-07-17 15:59 . 2009-07-17 15:59 -------- d-----w- c:\users\Benjamin\AppData\Local\temp
2009-07-15 16:03 . 2009-06-15 15:24 156672 ----a-w- c:\windows\system32\t2embed.dll
2009-07-15 16:03 . 2009-06-15 15:20 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-07-15 16:03 . 2009-06-15 15:20 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-07-15 16:03 . 2009-06-15 12:52 289792 ----a-w- c:\windows\system32\atmfd.dll
2009-06-26 15:15 . 2009-06-26 15:15 15256 ----a-w- c:\users\Benjamin\AppData\Roaming\Microsoft\IdentityCRL\PROD\ppcrlconfig.dll
2009-06-24 19:03 . 2009-06-17 09:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-24 19:03 . 2009-06-24 19:03 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-24 19:03 . 2009-06-24 19:03 -------- d-----w- c:\programdata\Malwarebytes
2009-06-24 19:03 . 2009-06-17 09:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-24 17:34 . 2009-06-24 17:35 -------- d-----w- C:\rsit
2009-06-24 14:57 . 2009-06-24 17:30 -------- d-----w- C:\Lop SD

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-17 12:04 . 2008-05-06 19:59 -------- d-----w- c:\users\Benjamin\AppData\Roaming\Skype
2009-07-17 12:03 . 2009-01-09 10:42 -------- d-----w- c:\users\Benjamin\AppData\Roaming\Free Download Manager
2009-07-17 11:49 . 2008-05-06 20:02 -------- d-----w- c:\users\Benjamin\AppData\Roaming\skypePM
2009-07-16 01:03 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-07-11 10:01 . 2006-11-02 15:45 669328 ----a-w- c:\windows\system32\perfh00C.dat
2009-07-11 10:01 . 2006-11-02 15:45 123350 ----a-w- c:\windows\system32\perfc00C.dat
2009-06-11 11:22 . 2007-07-10 12:09 -------- d-----w- c:\program files\Microsoft Works
2009-06-09 11:17 . 2009-06-09 11:17 456304 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb6F5.tmp.exe
2009-06-08 10:18 . 2009-06-08 10:18 -------- d-----w- c:\program files\Recuva
2009-06-04 19:00 . 2007-07-10 11:55 -------- d-----w- c:\program files\Common Files\Adobe
2009-05-19 13:08 . 2009-05-19 13:08 4608 ----a-w- c:\windows\system32\w95inf32.dll
2009-05-19 13:08 . 2009-05-19 13:08 2272 ----a-w- c:\windows\system32\w95inf16.dll
2009-05-09 05:50 . 2009-06-10 08:29 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-09 05:34 . 2009-06-10 08:29 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-04-23 12:43 . 2009-06-10 08:28 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-23 12:42 . 2009-06-10 08:29 636928 ----a-w- c:\windows\system32\localspl.dll
2009-04-21 11:55 . 2009-06-10 08:29 2033152 ----a-w- c:\windows\system32\win32k.sys
2009-04-19 22:57 . 2009-01-19 02:20 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2009-04-19 22:57 . 2009-01-19 02:20 110592 ----a-w- c:\windows\system32\OpenAL32.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-06-24_18.36.33 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-15 16:03 . 2009-06-15 14:58 23552 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6002.22152_none_ac0f1dd570f10812\lpk.dll
+ 2009-07-15 16:03 . 2009-06-15 14:58 72704 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6002.22152_none_ac0f1dd570f10812\fontsub.dll
+ 2009-07-15 16:03 . 2009-06-15 14:58 10240 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6002.22152_none_ac0f1dd570f10812\dciman32.dll
+ 2009-07-15 16:03 . 2009-06-15 12:45 34304 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6002.22152_none_ac0f1dd570f10812\atmlib.dll
+ 2009-07-15 16:03 . 2009-06-15 14:52 23552 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6002.18051_none_ab8480c057d44ef1\lpk.dll
+ 2009-07-15 16:03 . 2009-06-15 14:52 72704 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6002.18051_none_ab8480c057d44ef1\fontsub.dll
+ 2009-07-15 16:03 . 2009-06-15 14:51 10240 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6002.18051_none_ab8480c057d44ef1\dciman32.dll
+ 2009-07-15 16:03 . 2009-04-11 06:28 34304 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6002.18051_none_ab8480c057d44ef1\atmlib.dll
+ 2009-07-15 16:03 . 2009-06-15 15:22 23552 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6001.22450_none_aa26ab5973cc8040\lpk.dll
+ 2009-07-15 16:03 . 2009-06-15 15:20 72704 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6001.22450_none_aa26ab5973cc8040\fontsub.dll
+ 2009-07-15 16:03 . 2009-06-15 15:19 10240 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6001.22450_none_aa26ab5973cc8040\dciman32.dll
+ 2009-07-15 16:03 . 2009-06-15 15:19 34304 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6001.22450_none_aa26ab5973cc8040\atmlib.dll
+ 2008-11-09 14:41 . 2008-01-18 22:34 23552 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6001.18272_none_a9896d645abd4ddf\lpk.dll
+ 2009-07-15 16:03 . 2009-06-15 15:20 72704 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6001.18272_none_a9896d645abd4ddf\fontsub.dll
+ 2009-07-15 16:03 . 2009-06-15 15:20 10240 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6001.18272_none_a9896d645abd4ddf\dciman32.dll
+ 2006-11-02 08:38 . 2006-11-02 09:46 34304 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6001.18272_none_a9896d645abd4ddf\atmlib.dll
+ 2009-07-15 16:03 . 2009-06-15 15:04 24064 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6000.21067_none_a83c750976a7f2bc\lpk.dll
+ 2009-07-15 16:03 . 2009-06-15 15:03 72704 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6000.21067_none_a83c750976a7f2bc\fontsub.dll
+ 2009-07-15 16:03 . 2009-06-15 15:02 10240 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6000.21067_none_a83c750976a7f2bc\dciman32.dll
+ 2009-07-15 16:03 . 2009-06-15 15:02 34304 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6000.21067_none_a83c750976a7f2bc\atmlib.dll
+ 2009-07-15 16:03 . 2009-06-15 15:23 24064 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6000.16870_none_a7a12e2a5d988a40\lpk.dll
+ 2009-07-15 16:03 . 2009-06-15 15:22 72704 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6000.16870_none_a7a12e2a5d988a40\fontsub.dll
+ 2009-07-15 16:03 . 2009-06-15 15:21 10240 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6000.16870_none_a7a12e2a5d988a40\dciman32.dll
+ 2009-07-15 16:03 . 2009-06-15 15:20 34304 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6000.16870_none_a7a12e2a5d988a40\atmlib.dll
+ 2007-07-10 12:06 . 2009-07-17 15:50 74942 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-02-23 08:32 . 2009-07-17 11:50 13432 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-788108967-3940742589-920756846-1001_UserData.bin
+ 2008-02-20 20:20 . 2009-07-17 15:50 11010 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-788108967-3940742589-920756846-1000_UserData.bin
+ 2007-12-13 16:58 . 2009-07-17 12:20 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2007-12-13 16:58 . 2009-06-24 18:14 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2007-12-13 16:58 . 2009-06-24 18:14 98304 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2007-12-13 16:58 . 2009-07-17 12:20 98304 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2007-12-13 16:58 . 2009-07-17 12:20 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2007-12-13 16:58 . 2009-06-24 18:14 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-06-14 09:13 . 2009-05-10 17:11 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-06-14 09:13 . 2009-07-16 17:50 16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-06-14 09:13 . 2009-05-10 17:11 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-14 09:13 . 2009-07-16 17:50 32768 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-06-14 09:13 . 2009-07-16 17:50 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-06-14 09:13 . 2009-05-10 17:11 16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-04-26 13:13 . 2009-04-26 13:13 24064 c:\windows\Installer\92022.msi
+ 2005-11-15 15:56 . 2005-11-15 15:56 72192 c:\windows\Installer\3052bd3.msp
+ 2008-04-07 15:30 . 2009-07-11 09:50 4226 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-788108967-3940742589-920756846-1003_UserData.bin
- 2008-04-07 15:30 . 2009-06-19 16:40 4226 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-788108967-3940742589-920756846-1003_UserData.bin
+ 2009-07-17 15:48 . 2009-07-17 15:48 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-06-24 18:31 . 2009-06-24 18:31 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-07-17 15:48 . 2009-07-17 15:48 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-06-24 18:31 . 2009-06-24 18:31 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-06-25 10:12 . 2009-05-30 13:15 102912 c:\windows\winsxs\x86_microsoft-windows-ie-iecompat_31bf3856ad364e35_8.0.6001.22883_none_840ec88560132cdf\iecompat.dll
+ 2009-06-25 10:12 . 2009-06-02 03:27 102912 c:\windows\winsxs\x86_microsoft-windows-ie-iecompat_31bf3856ad364e35_8.0.6001.18793_none_837a5bce46fda906\iecompat.dll
+ 2009-07-15 16:03 . 2009-06-15 12:45 289792 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6002.22152_none_ac0f1dd570f10812\atmfd.dll
+ 2009-07-15 16:03 . 2009-06-15 12:42 289792 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6002.18051_none_ab8480c057d44ef1\atmfd.dll
+ 2009-07-15 16:03 . 2009-06-15 12:56 289792 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6001.22450_none_aa26ab5973cc8040\atmfd.dll
+ 2009-07-15 16:03 . 2009-06-15 12:52 289792 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6001.18272_none_a9896d645abd4ddf\atmfd.dll
+ 2009-07-15 16:03 . 2009-06-15 12:53 289792 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6000.21067_none_a83c750976a7f2bc\atmfd.dll
+ 2009-07-15 16:03 . 2009-06-15 13:03 289792 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6000.16870_none_a7a12e2a5d988a40\atmfd.dll
+ 2009-07-15 16:03 . 2009-06-15 15:00 156672 c:\windows\winsxs\x86_microsoft-windows-font-embedding_31bf3856ad364e35_6.0.6002.22152_none_b7fc28a4355e72c9\t2embed.dll
+ 2009-07-15 16:03 . 2009-06-15 14:53 156672 c:\windows\winsxs\x86_microsoft-windows-font-embedding_31bf3856ad364e35_6.0.6002.18051_none_b7718b8f1c41b9a8\t2embed.dll
+ 2009-07-15 16:03 . 2009-06-15 15:26 156672 c:\windows\winsxs\x86_microsoft-windows-font-embedding_31bf3856ad364e35_6.0.6001.22450_none_b613b6283839eaf7\t2embed.dll
+ 2009-07-15 16:03 . 2009-06-15 15:24 156672 c:\windows\winsxs\x86_microsoft-windows-font-embedding_31bf3856ad364e35_6.0.6001.18272_none_b57678331f2ab896\t2embed.dll
+ 2009-07-15 16:03 . 2009-06-15 15:09 156160 c:\windows\winsxs\x86_microsoft-windows-font-embedding_31bf3856ad364e35_6.0.6000.21067_none_b4297fd83b155d73\t2embed.dll
+ 2009-07-15 16:03 . 2009-06-15 15:29 156160 c:\windows\winsxs\x86_microsoft-windows-font-embedding_31bf3856ad364e35_6.0.6000.16870_none_b38e38f92205f4f7\t2embed.dll
+ 2006-11-02 13:02 . 2009-07-17 15:50 131578 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2006-11-02 10:33 . 2009-06-24 15:21 586980 c:\windows\System32\perfh009.dat
+ 2006-11-02 10:33 . 2009-07-11 10:01 586980 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-06-24 15:21 101052 c:\windows\System32\perfc009.dat
+ 2006-11-02 10:33 . 2009-07-11 10:01 101052 c:\windows\System32\perfc009.dat
+ 2009-02-10 17:44 . 2009-02-10 17:44 652800 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\vs_setup.msi
+ 2008-07-31 03:22 . 2008-07-31 03:22 442880 c:\windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\vs_setup.msi
+ 2008-04-10 14:16 . 2008-04-10 14:16 804864 c:\windows\Installer\f590fd.msi
+ 2008-03-25 19:51 . 2008-03-25 19:51 289792 c:\windows\Installer\e41f50.msi
+ 2009-01-19 02:20 . 2009-01-19 02:20 331264 c:\windows\Installer\923205.msi
+ 2009-04-20 13:15 . 2009-04-20 13:15 207872 c:\windows\Installer\89194.msp
+ 2008-02-24 10:16 . 2008-02-24 10:16 431104 c:\windows\Installer\8212c.msi
+ 2008-08-20 10:13 . 2008-08-20 10:13 369152 c:\windows\Installer\77378.msi
+ 2008-08-20 10:12 . 2008-08-20 10:12 289792 c:\windows\Installer\77373.msi
+ 2009-02-10 07:07 . 2009-02-10 07:07 528896 c:\windows\Installer\6afdf4.msp
+ 2008-11-09 17:07 . 2008-11-09 17:07 529408 c:\windows\Installer\6abb58.msi
+ 2008-12-24 11:34 . 2008-12-24 11:34 196096 c:\windows\Installer\64ba4.msi
+ 2008-06-06 09:40 . 2008-06-06 09:40 390656 c:\windows\Installer\5f9266.msi
+ 2008-02-25 10:48 . 2008-02-25 10:48 431104 c:\windows\Installer\5e008.msi
+ 2009-02-10 17:57 . 2009-02-10 17:57 438784 c:\windows\Installer\495f07.msi
+ 2008-11-13 11:34 . 2008-11-13 11:34 432640 c:\windows\Installer\45daf.msi
+ 2009-01-11 16:59 . 2009-01-11 16:59 620544 c:\windows\Installer\3eb158.msi
+ 2009-02-10 17:45 . 2009-02-10 17:45 648192 c:\windows\Installer\3d80b9.msi
+ 2007-07-10 12:11 . 2007-07-10 12:11 582656 c:\windows\Installer\3114a.msi
+ 2008-07-23 00:26 . 2008-07-23 00:26 110592 c:\windows\Installer\3052c26.msp
+ 2004-08-25 09:59 . 2004-08-25 09:59 361472 c:\windows\Installer\3052bbe.msp
+ 2006-02-23 09:47 . 2006-02-23 09:47 755712 c:\windows\Installer\3052b58.msp
+ 2008-05-07 15:39 . 2008-05-07 15:39 669184 c:\windows\Installer\3052afc.msp
+ 2004-03-11 09:46 . 2004-03-11 09:46 801792 c:\windows\Installer\3052ae5.msp
+ 2009-01-20 20:49 . 2009-01-20 20:49 211968 c:\windows\Installer\29bdb.msi
+ 2009-01-20 20:49 . 2009-01-20 20:49 229888 c:\windows\Installer\29bd5.msi
+ 2009-01-20 20:49 . 2009-01-20 20:49 200704 c:\windows\Installer\29bcf.msi
+ 2009-01-20 20:49 . 2009-01-20 20:49 279552 c:\windows\Installer\29bc9.msi
+ 2009-01-20 20:49 . 2009-01-20 20:49 249344 c:\windows\Installer\29bc3.msi
+ 2009-01-20 20:49 . 2009-01-20 20:49 252416 c:\windows\Installer\29bbd.msi
+ 2009-01-20 20:49 . 2009-01-20 20:49 275968 c:\windows\Installer\29bb7.msi
+ 2009-01-20 20:48 . 2009-01-20 20:48 276992 c:\windows\Installer\29bb1.msi
+ 2009-01-20 20:48 . 2009-01-20 20:48 200192 c:\windows\Installer\29bab.msi
+ 2009-01-20 20:48 . 2009-01-20 20:48 198656 c:\windows\Installer\29ba5.msi
+ 2009-01-20 20:48 . 2009-01-20 20:48 305152 c:\windows\Installer\29b9f.msi
+ 2009-01-20 20:48 . 2009-01-20 20:48 284672 c:\windows\Installer\29b99.msi
+ 2009-01-20 20:48 . 2009-01-20 20:48 321536 c:\windows\Installer\29b93.msi
+ 2009-01-20 20:48 . 2009-01-20 20:48 452096 c:\windows\Installer\29b86.msi
+ 2009-01-20 20:39 . 2009-01-20 20:39 213504 c:\windows\Installer\29b29.msi
+ 2008-02-23 17:18 . 2008-02-23 17:18 467968 c:\windows\Installer\2997d1.msi
+ 2007-07-10 12:28 . 2007-07-10 12:28 974848 c:\windows\Installer\27b1c.msi
+ 2008-03-30 19:44 . 2008-03-30 19:44 318464 c:\windows\Installer\247cef.msi
+ 2007-07-10 12:32 . 2007-07-10 12:32 997376 c:\windows\Installer\22678.msi
+ 2008-03-04 16:03 . 2008-03-04 16:03 289792 c:\windows\Installer\17629d.msi
+ 2008-02-24 10:27 . 2008-02-24 10:27 470528 c:\windows\Installer\128605.msi
+ 2008-12-04 16:34 . 2008-12-04 16:34 561664 c:\windows\Installer\11cd287.msi
+ 2008-12-13 08:58 . 2008-12-13 08:58 754688 c:\windows\Installer\118eb2.msp
+ 2009-04-02 23:59 . 2009-04-02 23:59 214016 c:\windows\Installer\1178e9a.msi
+ 2009-07-15 16:03 . 2009-06-17 08:02 2409776 c:\windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6002.22160_none_f4b74f0181eee730\OESpamFilter.dat
+ 2009-07-15 16:03 . 2009-06-17 07:35 2409776 c:\windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6002.18056_none_f43e83de68c3c37f\OESpamFilter.dat
+ 2009-07-15 16:03 . 2009-06-17 07:30 2409776 c:\windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6001.22459_none_f2e4af9f84b85a2a\OESpamFilter.dat
+ 2009-07-15 16:03 . 2009-06-17 07:35 2409776 c:\windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6001.18278_none_f24470cc6babdbc4\OESpamFilter.dat
+ 2009-07-15 16:03 . 2009-06-17 07:35 2409776 c:\windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6000.21074_none_f0e3a5eb87a6b883\OESpamFilter.dat
+ 2009-07-15 16:03 . 2009-06-17 07:36 2409776 c:\windows\winsxs\x86_microsoft-windows-oespamfilter-dat_31bf3856ad364e35_6.0.6000.16876_none_f05c31926e871825\OESpamFilter.dat
+ 2006-11-02 10:22 . 2009-07-16 11:16 6291456 c:\windows\System32\SMI\Store\Machine\schema.dat
- 2006-11-02 10:22 . 2009-06-24 12:47 6291456 c:\windows\System32\SMI\Store\Machine\schema.dat
+ 2007-07-10 12:32 . 2007-01-17 03:24 2830336 c:\windows\System32\LS_HSI.msi
+ 2006-11-02 12:44 . 2009-07-16 11:06 1644528 c:\windows\System32\FNTCACHE.DAT
- 2006-11-02 12:44 . 2009-06-24 18:06 1644528 c:\windows\System32\FNTCACHE.DAT
+ 2009-06-04 19:01 . 2009-06-04 19:01 4244480 c:\windows\Installer\c8f3ae.msi
+ 2008-08-20 14:30 . 2008-08-20 14:30 1420800 c:\windows\Installer\aec85d.msi
+ 2008-10-24 17:47 . 2008-10-24 17:47 1396224 c:\windows\Installer\9577d4.msi
+ 2009-04-22 13:16 . 2009-04-22 13:16 4870144 c:\windows\Installer\89180.msp
+ 2009-04-29 13:03 . 2009-04-29 13:03 8404992 c:\windows\Installer\8916a.msp
+ 2008-11-26 10:01 . 2008-11-26 10:01 3667968 c:\windows\Installer\8021f4.msp
+ 2009-04-30 21:02 . 2009-04-30 21:02 9628672 c:\windows\Installer\7b668.msp
+ 2009-01-02 18:45 . 2009-01-02 18:45 2442240 c:\windows\Installer\58b6fe.msi
+ 2009-01-02 18:44 . 2009-01-02 18:44 1780224 c:\windows\Installer\58b6f7.msi
+ 2009-01-02 18:44 . 2009-01-02 18:44 1718272 c:\windows\Installer\58b6f1.msi
+ 2009-01-02 18:43 . 2009-01-02 18:43 1725952 c:\windows\Installer\58b6eb.msi
+ 2009-01-02 18:43 . 2009-01-02 18:43 1954304 c:\windows\Installer\58b6e5.msi
+ 2009-01-02 18:43 . 2009-01-02 18:43 1826816 c:\windows\Installer\58b6df.msi
+ 2009-01-02 18:43 . 2009-01-02 18:43 1726976 c:\windows\Installer\58b6c8.msi
+ 2009-01-02 18:42 . 2009-01-02 18:42 1879040 c:\windows\Installer\58b6c2.msi
+ 2009-01-02 18:42 . 2009-01-02 18:42 1730048 c:\windows\Installer\58b6bc.msi
+ 2009-01-02 18:42 . 2009-01-02 18:42 1761792 c:\windows\Installer\58b6b6.msi
+ 2009-01-02 18:42 . 2009-01-02 18:42 1735680 c:\windows\Installer\58b6b0.msi
+ 2009-01-02 18:41 . 2009-01-02 18:41 1744384 c:\windows\Installer\58b6aa.msi
+ 2009-01-02 18:41 . 2009-01-02 18:41 1842688 c:\windows\Installer\58b6a4.msi
+ 2009-01-02 18:40 . 2009-01-02 18:40 2159104 c:\windows\Installer\58b69d.msi
+ 2009-01-02 18:39 . 2009-01-02 18:39 1715712 c:\windows\Installer\58b697.msi
+ 2009-01-02 18:39 . 2009-01-02 18:39 1716224 c:\windows\Installer\58b690.msi
+ 2009-01-02 18:39 . 2009-01-02 18:39 1716736 c:\windows\Installer\58b689.msi
+ 2009-01-02 18:39 . 2009-01-02 18:39 1716224 c:\windows\Installer\58b682.msi
+ 2009-01-02 18:39 . 2009-01-02 18:39 1728000 c:\windows\Installer\58b67b.msi
+ 2009-01-02 18:38 . 2009-01-02 18:38 1718272 c:\windows\Installer\58b675.msi
+ 2009-01-02 18:38 . 2009-01-02 18:38 1761792 c:\windows\Installer\58b66e.msi
+ 2009-01-02 18:38 . 2009-01-02 18:38 1753088 c:\windows\Installer\58b668.msi
+ 2009-01-02 18:38 . 2009-01-02 18:38 1720832 c:\windows\Installer\58b662.msi
+ 2009-01-02 18:37 . 2009-01-02 18:37 2595840 c:\windows\Installer\58b65c.msi
+ 2009-01-02 18:34 . 2009-01-02 18:34 1826304 c:\windows\Installer\58b656.msi
+ 2009-01-02 18:34 . 2009-01-02 18:34 1716736 c:\windows\Installer\58b650.msi
+ 2009-01-02 18:33 . 2009-01-02 18:33 1767424 c:\windows\Installer\58b64a.msi
+ 2008-02-28 11:39 . 2008-02-28 11:39 3452416 c:\windows\Installer\50e1a.msi
+ 2008-08-18 10:38 . 2008-08-18 10:38 3559936 c:\windows\Installer\4d675.msp
+ 2008-03-03 21:10 . 2008-03-03 21:10 1273344 c:\windows\Installer\38c177.msi
+ 2009-03-30 16:53 . 2009-03-30 16:53 2714624 c:\windows\Installer\35d87.msi
+ 2007-07-10 12:16 . 2007-07-10 12:16 2859008 c:\windows\Installer\33b31.msi
+ 2009-01-31 12:10 . 2009-01-31 12:10 1021952 c:\windows\Installer\337adf.msi
+ 2007-07-10 12:11 . 2007-07-10 12:11 4540928 c:\windows\Installer\31144.msi
+ 2008-10-28 14:59 . 2008-10-28 14:59 8413184 c:\windows\Installer\3052bfc.msp
+ 2008-09-04 14:52 . 2008-09-04 14:52 4337664 c:\windows\Installer\3052be7.msp
+ 2008-05-06 09:30 . 2008-05-06 09:30 9577984 c:\windows\Installer\3052baa.msp
+ 2008-01-11 13:13 . 2008-01-11 13:13 5862912 c:\windows\Installer\3052b95.msp
+ 2008-01-14 13:26 . 2008-01-14 13:26 4478464 c:\windows\Installer\3052b6e.msp
+ 2006-02-27 15:31 . 2006-02-27 15:31 1269248 c:\windows\Installer\3052b59.msp
+ 2006-02-23 09:46 . 2006-02-23 09:46 2990080 c:\windows\Installer\3052b57.msp
+ 2006-03-28 14:37 . 2006-03-28 14:37 6956032 c:\windows\Installer\3052b41.msp
+ 2006-08-29 16:50 . 2006-08-29 16:50 3210240 c:\windows\Installer\3052b26.msp
+ 2004-09-13 03:34 . 2004-09-13 03:34 1432576 c:\windows\Installer\3052ad1.msp
+ 2008-06-11 19:13 . 2008-06-11 19:13 7988224 c:\windows\Installer\3052a7d.msp
+ 2008-03-31 15:35 . 2008-03-31 15:35 8309760 c:\windows\Installer\3052a67.msp
+ 2006-02-22 08:46 . 2006-02-22 08:46 2334720 c:\windows\Installer\3052a53.msp
+ 2009-01-20 20:49 . 2009-01-20 20:49 1069056 c:\windows\Installer\29be2.msi
+ 2009-01-20 20:48 . 2009-01-20 20:48 1233408 c:\windows\Installer\29b8d.msi
+ 2007-07-10 12:32 . 2007-07-10 12:32 7726592 c:\windows\Installer\22672.msi
+ 2008-05-10 09:28 . 2008-05-10 09:28 1242624 c:\windows\Installer\19ea25.msi
+ 2008-03-30 19:26 . 2008-03-30 19:26 1689600 c:\windows\Installer\13823c.msi
+ 2009-05-01 10:19 . 2009-07-16 01:03 73681687 c:\windows\winsxs\ManifestCache\6.0.6002.18005_001c11ba_blobs.bin
+ 2006-11-02 10:24 . 2009-07-07 15:10 24539592 c:\windows\System32\mrt.exe
+ 2009-05-05 16:06 . 2009-05-05 16:06 17515008 c:\windows\Installer\891aa.msp
+ 2009-03-09 13:55 . 2009-03-09 13:55 17526272 c:\windows\Installer\6afe0a.msp
+ 2008-01-24 14:56 . 2008-01-24 14:56 13570560 c:\windows\Installer\3052c12.msp
+ 2008-10-28 18:17 . 2008-10-28 18:17 17520128 c:\windows\Installer\3052b11.msp
+ 2005-09-25 10:46 . 2005-09-25 10:46 16084480 c:\windows\Installer\1223c91.msp
+ 2004-02-21 20:41 . 2004-02-21 20:41 60819164 c:\windows\Installer\118f2d.msp
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LESS CITY AMEN SETUP"="c:\programdata\SOFTWARE STOP CAKE.74ni4dy" [X]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-05-22 151552]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-17 39408]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acer Empowering Technology Monitor"="c:\acer\Empowering Technology\SysMonitor.exe" [2007-05-31 326440]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-25 457216]
"PCMService"="c:\acer\Empowering Technology\eMode\PCM\PCMService.exe" [2007-01-12 151552]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-05-22 151552]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-04 136600]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2007-08-03 63048]
"Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2008-04-04 88584]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-06-20 4493312]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-2-28 110592]
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-7-10 535336]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{A9BB1744-ADE0-4DB1-9DE6-68AC382FC033}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{92B8D59A-32A0-490C-9B13-BD644FC6BEB3}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{EBF00423-765B-4BCB-9694-FD0A5747AB01}"= UDP:c:\acer\Empowering Technology\eMode\PCM\PCMService.exe:CyberLink PowerCinema Resident Program
"{E7521040-F2A1-46DE-82BC-41CE0035A1D0}"= TCP:c:\acer\Empowering Technology\eMode\PCM\PCMService.exe:CyberLink PowerCinema Resident Program
"{FEA6D843-5B65-4E6A-8340-C19061F88BEC}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{1117BCBC-DA31-44FC-9F62-E251BCDA26FB}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{583C0994-C105-4F20-82D8-044A8CE0DDB6}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{1AB4849A-7842-4EF6-B610-E95808453274}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{B6841A6F-4A1F-492E-873B-00D050429D78}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{A75A8936-70E0-47C3-9A17-32F0673D14F0}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{D13EED16-3BC6-4706-9606-F604FF7B1251}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{19E9630E-5818-4B87-9EB2-89CB6E40C9A5}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"TCP Query User{2DCD685F-286E-48AF-AFB3-2078A109DA51}c:\\program files\\microsoft office\\office10\\frontpg.exe"= UDP:c:\program files\microsoft office\office10\frontpg.exe:Microsoft FrontPage
"UDP Query User{2BA55028-CE81-40BA-BD36-2721B3EC6515}c:\\program files\\microsoft office\\office10\\frontpg.exe"= TCP:c:\program files\microsoft office\office10\frontpg.exe:Microsoft FrontPage
"{02FF2A6C-28CE-4472-AFF8-5C6BFACF845A}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{5208DC6E-E079-4E6B-A0D2-49F278C8BBC5}c:\\program files\\microsoft office\\office10\\frontpg.exe"= UDP:c:\program files\microsoft office\office10\frontpg.exe:Microsoft FrontPage
"UDP Query User{A126F3A5-0A02-457F-9B8D-6385328B235B}c:\\program files\\microsoft office\\office10\\frontpg.exe"= TCP:c:\program files\microsoft office\office10\frontpg.exe:Microsoft FrontPage
"{BD8C02AA-8AC5-4BA1-BB96-7F108CA13350}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{03030BB1-DE2E-4756-A17C-372E43A92DEF}c:\\users\\benjamin\\downloads\\metin2.bin"= UDP:c:\users\benjamin\downloads\metin2.bin:metin2
"UDP Query User{ECEEBC53-5ECF-4B73-AD18-CCCF71B65E4C}c:\\users\\benjamin\\downloads\\metin2.bin"= TCP:c:\users\benjamin\downloads\metin2.bin:metin2
"TCP Query User{64975B56-C199-470B-B774-601BD3E5F8F8}c:\\program files\\wolfenstein - enemy territory\\et.exe"= UDP:c:\program files\wolfenstein - enemy territory\et.exe:ET
"UDP Query User{8227218B-DFCB-424E-84BB-DE52AC5F6809}c:\\program files\\wolfenstein - enemy territory\\et.exe"= TCP:c:\program files\wolfenstein - enemy territory\et.exe:ET
"TCP Query User{040A75C7-018E-41E2-9CA5-9832D7E04DB9}c:\\program files\\sierra\\fearcombat\\fpupdate.exe"= UDP:c:\program files\sierra\fearcombat\fpupdate.exe:fpupdate
"UDP Query User{3B95ADF2-B82D-498A-9311-6434CE8D55E3}c:\\program files\\sierra\\fearcombat\\fpupdate.exe"= TCP:c:\program files\sierra\fearcombat\fpupdate.exe:fpupdate
"TCP Query User{A7E2A9EF-FEBA-4371-B54F-CD7689309B91}c:\\program files\\microsoft games\\age of empires ii\\empires2.exe"= UDP:c:\program files\microsoft games\age of empires ii\empires2.exe:Age of Empires II
"UDP Query User{DF67EFF0-27A9-41BC-B549-BE3469D73B8D}c:\\program files\\microsoft games\\age of empires ii\\empires2.exe"= TCP:c:\program files\microsoft games\age of empires ii\empires2.exe:Age of Empires II
"TCP Query User{ADD5B796-BA49-4E5B-BD32-80DD137792BE}c:\\ut2003\\system\\ut2003.exe"= UDP:c:\ut2003\system\ut2003.exe:UT2003
"UDP Query User{0A099039-F3D1-46A7-892D-2AA14C0DD8A2}c:\\ut2003\\system\\ut2003.exe"= TCP:c:\ut2003\system\ut2003.exe:UT2003
"TCP Query User{E49C2C47-C6E8-4DD9-B347-71AAB294C660}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{A06EC744-8627-4E6B-8690-279DCBE40796}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"{F95A7399-B9F6-47D9-9C3C-9CDBC64CECB8}"= UDP:c:\program files\EA GAMES\Battlefield 2 Demo\BF2.exe:Battlefield 2
"{FA73A14D-7D1E-4DC5-9013-7FF9C6DF4436}"= TCP:c:\program files\EA GAMES\Battlefield 2 Demo\BF2.exe:Battlefield 2
"{AB8C0401-E459-4E53-AB51-6AFAC61DED7F}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{DB9B16CC-69CD-485D-91AA-6C8A8F0D5655}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{58DD5619-155A-4769-B9B2-B4376FE79ED5}"= UDP:c:\program files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires III
"{F0749A17-CE3A-41E9-ACF1-958750D1BB5B}"= TCP:c:\program files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires III
"TCP Query User{34E592FC-1C4A-4B46-9FF5-0FE1B52D56EE}c:\\program files\\wormux\\wormux.exe"= UDP:c:\program files\wormux\wormux.exe:Wormux is a convivial mass murder game.
"UDP Query User{D1D1689A-DF27-4929-A71D-745E188E1EF8}c:\\program files\\wormux\\wormux.exe"= TCP:c:\program files\wormux\wormux.exe:Wormux is a convivial mass murder game.
"TCP Query User{CB06FC56-1878-4880-B770-BC3EEDEDF2A1}c:\\program files\\live-player\\live-player.exe"= UDP:c:\program files\live-player\live-player.exe:Live-Player
"UDP Query User{FC7C400E-CD8F-404E-A276-07EFD0703DF3}c:\\program files\\live-player\\live-player.exe"= TCP:c:\program files\live-player\live-player.exe:Live-Player
"{92B1BAAD-9025-4F7D-AD12-67DF78CAFC4F}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{8DD44C06-465E-4A0F-9F3F-CBF5AA473160}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{679ABFA3-8BD4-4D70-862F-37B2E9B2F2A3}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{B8CEC155-90CA-4B85-A07F-84B831154709}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{0ED8BA53-75B0-40AA-ACF1-05259239D2BC}"= UDP:12755:BitComet 12755 TCP
"{3B7AABDD-4ABF-4431-AAFF-E8E5E1A2C71B}"= TCP:12755:BitComet 12755 UDP
"TCP Query User{F65560EC-9D82-4A6D-BCF2-6CFD14D933DA}c:\\program files\\maiet\\gunz\\gunzlauncher.exe"= UDP:c:\program files\maiet\gunz\gunzlauncher.exe:GunzLauncher
"UDP Query User{DCFE51C3-44E7-4BE4-9A27-3160C1888072}c:\\program files\\maiet\\gunz\\gunzlauncher.exe"= TCP:c:\program files\maiet\gunz\gunzlauncher.exe:GunzLauncher
"{026797B0-C061-4385-ACCA-F817D2C80ABF}"= UDP:c:\program files\AeriaGames\ProjectTorque\ProjectTorque.bin:Project Torqu
"{5F92DFDB-95B3-414B-9F70-F3B674EBFCF0}"= TCP:c:\program files\AeriaGames\ProjectTorque\ProjectTorque.bin:Project Torqu

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"DoNotAllowExceptions"= 0 (0x0)

R0 pavboot;pavboot;c:\windows\System32\drivers\pavboot.sys [07/01/2009 19:31 28544]
R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [03/04/2008 17:16 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [03/04/2008 17:16 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [23/02/2008 12:03 51792]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [03/08/2007 15:09 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\System32\drivers\LMIRfsDriver.sys [30/03/2008 21:26 47640]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [22/09/2008 21:47 1153368]
R3 e4usbaw;USB ADSL2 WAN Adapter;c:\windows\System32\drivers\e4usbaw.sys [23/02/2008 12:23 104344]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\System32\drivers\SiSGB6.sys [10/07/2007 22:29 46592]
S2 E4LOADER;General Purpose USB Driver (e4ldr.sys);c:\windows\System32\drivers\e4ldr.sys [23/02/2008 12:23 69656]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\System32\drivers\mbamswissarmy.sys [24/06/2009 21:03 38160]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\System32\drivers\PCAMp50.sys [23/02/2008 12:21 28224]
S3 SiS6350;SiS6350;c:\windows\System32\drivers\SISGRKMD.sys [10/07/2007 22:29 454520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
.
Contents of the 'Scheduled Tasks' folder

2008-05-17 c:\windows\Tasks\SyncBack mes docs Joëlle.job
- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [2008-05-17 13:16]

2009-07-17 c:\windows\Tasks\User_Feed_Synchronization-{909E66DD-55D9-4815-985B-640AA5492C71}.job
- c:\windows\system32\msfeedssync.exe [2009-05-08 11:31]
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{ECDEE021-0D17-467F-A1FF-C7A115230949} - (no file)
HKLM-Run-SearchSettings - c:\program files\Search Settings\SearchSettings.exe

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.fr/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://fr.fr.acer.yahoo.com
uSearchURL,(Default) = hxxp://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
IE: Compare Prices with &Dealio - c:\users\Joëlle\AppData\LocalLow\Dealio\kb125\res\DealioSearch.html
IE: Download with &Shareaza - c:\program files\Crux P2P\Plugins\RazaWebHook.dll/3000
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.zebulon.fr/scan8/oscan8.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-17 17:59
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-07-17 18:03
ComboFix-quarantined-files.txt 2009-07-17 16:03
ComboFix2.txt 2009-06-24 18:41

Pre-Run: 6 654 582 784 octets libres
Post-Run: 6 512 099 328 octets libres

409 --- E O F --- 2009-07-16 01:04

salut Inferno, je fais ça des que possible

Refais un combofix stp.

Bonjour,

Hier soir j'ai lancé un nouveau test d'antimalware, et l'ordi a planté de nouveau. Je dois essayer de résoudre ce problème de plantage avant de continuer la désinfection du PC. Que pensez-vous de ces bluescreen qui apparaissent un peu n'importe quand, est-ce du à un problème de pilote?

Merci

OK je vais en relancer un mais c'est l'ordi de ma mère donc je vais devoir le laisser tourner et je lui dirai d'enregistrer le fichier log que je vous ferai passer des que je reviens chez elle.
Merci bcp à tous les 2 en tous cas.

Tu prends la suite BefaX je vais au Dodo :)

Refais en un complet si tu peux.

Bon j'ai eu un souci bluescreen + redémarrage pendant le scan d'antimalware, du coup par manque de temps, j'ai choisi l'examen rapide et voilà le résultat

Malwarebytes' Anti-Malware 1.38
Version de la base de données: 2329
Windows 6.0.6001 Service Pack 1

24/06/2009 22:53:02
mbam-log-2009-06-24 (22-53-02).txt

Type de recherche: Examen rapide
Eléments examinés: 104550
Temps écoulé: 4 minute(s), 24 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
C:\Users\Benjamin\AppData\Roaming\EoRezo\SoftwareUpdate\SoftwareUpdateHP.exe (Adware.EoRezo) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\softwarehelper (Adware.EoRezo) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\Local Page (Hijack.Search) -> Bad: (http://www.iesearch.com/) Good: (https://www.google.com/?gws_rd=ssl -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Users\Benjamin\AppData\Roaming\EoRezo\SoftwareUpdate\SoftwareUpdateHP.exe (Adware.EoRezo) -> Quarantined and deleted successfully.

Bah ca on peut pas trop le prevoir, ca ddepend deja de malwarebytes, ne t'inquietes je te ferais supprimer tous les outils utilisés pendant la desinfection apres.

Juste une question est-ce que je devrai faire autre chose après ça ou c'est fini ?

Bien,

1/ Telechargement :

# Télécharge Malwarebytes' Anti-Malware

NOTE : S'il te manque COMCTL32.OCX alors télécharge le --> comctl32.ocx

2/ Installation et mise a jour :

# Installe MBAM en double-cliquant sur Mbam-setup.exe ,il se mettra a jour automatiquement.

# Une fois a jour, le programme va se lancer. Clique sur l'onglet Paramètre, et coche la case : "Arrêter internet explorer pendant la suppression".

3/ Recherche :

# Clique a présent sur l'onglet Recherche et coche la case : "exécuter un examen complet".

# Clique ensuite sur "rechercher".

Laisse-le scanner ton PC ...

4/ Suppression :

# Si des éléments on été trouvés ~> Clique sur "Supprimer la selection".

# Si le programme te demande de redemarrer ~> Clique sur "yes".

# A la fin, un rapport va s'ouvrir dans le Bloc-notes ~> Sauvegarde le de manière a le retrouver pour le poster sur le forum.

# Copie (Ctrl + C) et colle (Ctrl + V) le rapport dans ton prochain message stp.

PS : Les rapports sont aussi classés par date et heure du scan dans l'onglet Rapport/Log

Données : Un tutoriel de chez Malekal est disponible ~>

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

Salut, ca y est voilà le rapport de combofix

Petit souci j'ai eu, désactivé avast j'avais fait. Mais message d'erreur Combofix m'a écris comme quoi j'avais avast actif, j'ai continué quand même car j'étais sur de mon coup mais il m'a eu au redémarrage il s'est réactivé je n'y avais pas pensé. Je l'ai désactivé à nouveau j'espère que ça n'a pas géné combofix.

le rapport

ComboFix 09-06-23.01 - Joëlle 24/06/2009 20:17.1 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Basique 6.0.6001.1.1252.33.1036.18.2047.1258 [GMT 2:00]
Lancé depuis: s:\docs joëlle\Bureau\avril.exe
AV: avast! antivirus 4.8.1229 [VPS 081124-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: avast! antivirus 4.8.1229 [VPS 081124-0] *enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-788108967-3940742589-920756846-500
c:\windows\system32\ATIODCLI.exe
c:\windows\system32\ATIODE.exe
c:\$recycle.bin\S-1-5-21-788108967-3940742589-920756846-500\desktop.ini
c:\users\Benjamin\AppData\Local\aifsamrx.dat
c:\users\Benjamin\AppData\Local\aifsamrx_nav.dat
c:\users\Benjamin\AppData\Local\aifsamrx_navps.dat
c:\windows\system32\autorun.ini

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_Boonty Games

((((((((((((((((((((((((((((( Fichiers créés du 2009-05-24 au 2009-06-24 ))))))))))))))))))))))))))))))))))))
.

2009-06-24 18:25 . 2009-06-24 18:25 -------- d-----w- c:\users\LogMeInRemoteUser\AppData\Local\temp
2009-06-24 18:25 . 2009-06-24 18:25 -------- d-----w- c:\users\Guillaume\AppData\Local\temp
2009-06-24 18:25 . 2009-06-24 18:25 -------- d-----w- c:\users\Benjamin\AppData\Local\temp
2009-06-24 17:34 . 2009-06-24 17:35 -------- d-----w- C:\rsit
2009-06-24 14:57 . 2009-06-24 17:30 -------- d-----w- C:\Lop SD
2009-06-10 08:28 . 2009-04-23 12:43 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-06-09 11:17 . 2009-06-09 11:17 456304 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb6F5.tmp.exe
2009-06-08 10:18 . 2009-06-08 10:18 -------- d-----w- c:\program files\Recuva
2009-05-27 08:57 . 2009-05-27 08:57 -------- d-----w- c:\users\Benjamin\AppData\Local\Mozilla

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-24 15:21 . 2006-11-02 15:45 669328 ----a-w- c:\windows\system32\perfh00C.dat
2009-06-24 15:21 . 2006-11-02 15:45 123350 ----a-w- c:\windows\system32\perfc00C.dat
2009-06-24 12:45 . 2008-05-06 19:59 -------- d-----w- c:\users\Benjamin\AppData\Roaming\Skype
2009-06-24 12:05 . 2009-01-09 10:42 -------- d-----w- c:\users\Benjamin\AppData\Roaming\Free Download Manager
2009-06-24 12:05 . 2008-05-06 20:02 -------- d-----w- c:\users\Benjamin\AppData\Roaming\skypePM
2009-06-11 11:22 . 2007-07-10 12:09 -------- d-----w- c:\program files\Microsoft Works
2009-06-04 19:00 . 2007-07-10 11:55 -------- d-----w- c:\program files\Common Files\Adobe
2009-05-19 13:08 . 2009-05-19 13:08 4608 ----a-w- c:\windows\system32\w95inf32.dll
2009-05-19 13:08 . 2009-05-19 13:08 2272 ----a-w- c:\windows\system32\w95inf16.dll
2009-05-14 09:29 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-05-09 05:50 . 2009-06-10 08:29 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-09 05:34 . 2009-06-10 08:29 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-04-23 12:42 . 2009-06-10 08:29 636928 ----a-w- c:\windows\system32\localspl.dll
2009-04-21 11:55 . 2009-06-10 08:29 2033152 ----a-w- c:\windows\system32\win32k.sys
2009-04-19 22:57 . 2009-01-19 02:20 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2009-04-19 22:57 . 2009-01-19 02:20 110592 ----a-w- c:\windows\system32\OpenAL32.dll
2009-04-03 00:00 . 2009-04-02 23:59 22328 ----a-w- c:\users\Benjamin\AppData\Roaming\PnkBstrK.sys
2009-04-03 00:00 . 2009-04-02 23:59 22328 ----a-w- c:\users\Benjamin\AppData\Roaming\PnkBstrK.sys
2009-04-03 00:00 . 2008-02-24 23:36 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-04-03 00:00 . 2008-02-24 23:36 107832 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-04-03 00:00 . 2009-03-25 15:52 2246144 ----a-w- c:\windows\system32\pbsvc.exe
2009-04-03 00:00 . 2008-02-24 23:36 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LESS CITY AMEN SETUP"="c:\programdata\SOFTWARE STOP CAKE.74ni4dy" [X]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-05-22 151552]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-17 39408]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acer Empowering Technology Monitor"="c:\acer\Empowering Technology\SysMonitor.exe" [2007-05-31 326440]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-04-25 457216]
"PCMService"="c:\acer\Empowering Technology\eMode\PCM\PCMService.exe" [2007-01-12 151552]
"WarReg_PopUp"="c:\acer\WR_PopUp\WarReg_PopUp.exe" [2006-11-05 57344]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-05-22 151552]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"SearchSettings"="c:\program files\Search Settings\SearchSettings.exe" [2007-12-06 1069920]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-04 136600]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2007-08-03 63048]
"Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2008-04-04 88584]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-29 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-06-20 4493312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SoftwareHelper"="c:\users\Benjamin\AppData\Roaming\EoRezo\SoftwareUpdate\SoftwareUpdateHP.exe" [2008-12-09 368224]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-2-28 110592]
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-7-10 535336]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{A9BB1744-ADE0-4DB1-9DE6-68AC382FC033}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{92B8D59A-32A0-490C-9B13-BD644FC6BEB3}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{EBF00423-765B-4BCB-9694-FD0A5747AB01}"= UDP:c:\acer\Empowering Technology\eMode\PCM\PCMService.exe:CyberLink PowerCinema Resident Program
"{E7521040-F2A1-46DE-82BC-41CE0035A1D0}"= TCP:c:\acer\Empowering Technology\eMode\PCM\PCMService.exe:CyberLink PowerCinema Resident Program
"{FEA6D843-5B65-4E6A-8340-C19061F88BEC}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{1117BCBC-DA31-44FC-9F62-E251BCDA26FB}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{583C0994-C105-4F20-82D8-044A8CE0DDB6}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{1AB4849A-7842-4EF6-B610-E95808453274}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{B6841A6F-4A1F-492E-873B-00D050429D78}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{A75A8936-70E0-47C3-9A17-32F0673D14F0}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{D13EED16-3BC6-4706-9606-F604FF7B1251}"= UDP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"{19E9630E-5818-4B87-9EB2-89CB6E40C9A5}"= TCP:c:\program files\MSN Messenger\msnmsgr.exe:MSN Messenger 7.0
"TCP Query User{2DCD685F-286E-48AF-AFB3-2078A109DA51}c:\\program files\\microsoft office\\office10\\frontpg.exe"= UDP:c:\program files\microsoft office\office10\frontpg.exe:Microsoft FrontPage
"UDP Query User{2BA55028-CE81-40BA-BD36-2721B3EC6515}c:\\program files\\microsoft office\\office10\\frontpg.exe"= TCP:c:\program files\microsoft office\office10\frontpg.exe:Microsoft FrontPage
"{02FF2A6C-28CE-4472-AFF8-5C6BFACF845A}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{5208DC6E-E079-4E6B-A0D2-49F278C8BBC5}c:\\program files\\microsoft office\\office10\\frontpg.exe"= UDP:c:\program files\microsoft office\office10\frontpg.exe:Microsoft FrontPage
"UDP Query User{A126F3A5-0A02-457F-9B8D-6385328B235B}c:\\program files\\microsoft office\\office10\\frontpg.exe"= TCP:c:\program files\microsoft office\office10\frontpg.exe:Microsoft FrontPage
"{BD8C02AA-8AC5-4BA1-BB96-7F108CA13350}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{03030BB1-DE2E-4756-A17C-372E43A92DEF}c:\\users\\benjamin\\downloads\\metin2.bin"= UDP:c:\users\benjamin\downloads\metin2.bin:metin2
"UDP Query User{ECEEBC53-5ECF-4B73-AD18-CCCF71B65E4C}c:\\users\\benjamin\\downloads\\metin2.bin"= TCP:c:\users\benjamin\downloads\metin2.bin:metin2
"TCP Query User{64975B56-C199-470B-B774-601BD3E5F8F8}c:\\program files\\wolfenstein - enemy territory\\et.exe"= UDP:c:\program files\wolfenstein - enemy territory\et.exe:ET
"UDP Query User{8227218B-DFCB-424E-84BB-DE52AC5F6809}c:\\program files\\wolfenstein - enemy territory\\et.exe"= TCP:c:\program files\wolfenstein - enemy territory\et.exe:ET
"TCP Query User{040A75C7-018E-41E2-9CA5-9832D7E04DB9}c:\\program files\\sierra\\fearcombat\\fpupdate.exe"= UDP:c:\program files\sierra\fearcombat\fpupdate.exe:fpupdate
"UDP Query User{3B95ADF2-B82D-498A-9311-6434CE8D55E3}c:\\program files\\sierra\\fearcombat\\fpupdate.exe"= TCP:c:\program files\sierra\fearcombat\fpupdate.exe:fpupdate
"TCP Query User{A7E2A9EF-FEBA-4371-B54F-CD7689309B91}c:\\program files\\microsoft games\\age of empires ii\\empires2.exe"= UDP:c:\program files\microsoft games\age of empires ii\empires2.exe:Age of Empires II
"UDP Query User{DF67EFF0-27A9-41BC-B549-BE3469D73B8D}c:\\program files\\microsoft games\\age of empires ii\\empires2.exe"= TCP:c:\program files\microsoft games\age of empires ii\empires2.exe:Age of Empires II
"TCP Query User{ADD5B796-BA49-4E5B-BD32-80DD137792BE}c:\\ut2003\\system\\ut2003.exe"= UDP:c:\ut2003\system\ut2003.exe:UT2003
"UDP Query User{0A099039-F3D1-46A7-892D-2AA14C0DD8A2}c:\\ut2003\\system\\ut2003.exe"= TCP:c:\ut2003\system\ut2003.exe:UT2003
"TCP Query User{E49C2C47-C6E8-4DD9-B347-71AAB294C660}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{A06EC744-8627-4E6B-8690-279DCBE40796}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"{F95A7399-B9F6-47D9-9C3C-9CDBC64CECB8}"= UDP:c:\program files\EA GAMES\Battlefield 2 Demo\BF2.exe:Battlefield 2
"{FA73A14D-7D1E-4DC5-9013-7FF9C6DF4436}"= TCP:c:\program files\EA GAMES\Battlefield 2 Demo\BF2.exe:Battlefield 2
"{AB8C0401-E459-4E53-AB51-6AFAC61DED7F}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{DB9B16CC-69CD-485D-91AA-6C8A8F0D5655}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{58DD5619-155A-4769-B9B2-B4376FE79ED5}"= UDP:c:\program files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires III
"{F0749A17-CE3A-41E9-ACF1-958750D1BB5B}"= TCP:c:\program files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires III
"TCP Query User{34E592FC-1C4A-4B46-9FF5-0FE1B52D56EE}c:\\program files\\wormux\\wormux.exe"= UDP:c:\program files\wormux\wormux.exe:Wormux is a convivial mass murder game.
"UDP Query User{D1D1689A-DF27-4929-A71D-745E188E1EF8}c:\\program files\\wormux\\wormux.exe"= TCP:c:\program files\wormux\wormux.exe:Wormux is a convivial mass murder game.
"TCP Query User{CB06FC56-1878-4880-B770-BC3EEDEDF2A1}c:\\program files\\live-player\\live-player.exe"= UDP:c:\program files\live-player\live-player.exe:Live-Player
"UDP Query User{FC7C400E-CD8F-404E-A276-07EFD0703DF3}c:\\program files\\live-player\\live-player.exe"= TCP:c:\program files\live-player\live-player.exe:Live-Player
"{92B1BAAD-9025-4F7D-AD12-67DF78CAFC4F}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{8DD44C06-465E-4A0F-9F3F-CBF5AA473160}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{679ABFA3-8BD4-4D70-862F-37B2E9B2F2A3}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{B8CEC155-90CA-4B85-A07F-84B831154709}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{0ED8BA53-75B0-40AA-ACF1-05259239D2BC}"= UDP:12755:BitComet 12755 TCP
"{3B7AABDD-4ABF-4431-AAFF-E8E5E1A2C71B}"= TCP:12755:BitComet 12755 UDP
"TCP Query User{F65560EC-9D82-4A6D-BCF2-6CFD14D933DA}c:\\program files\\maiet\\gunz\\gunzlauncher.exe"= UDP:c:\program files\maiet\gunz\gunzlauncher.exe:GunzLauncher
"UDP Query User{DCFE51C3-44E7-4BE4-9A27-3160C1888072}c:\\program files\\maiet\\gunz\\gunzlauncher.exe"= TCP:c:\program files\maiet\gunz\gunzlauncher.exe:GunzLauncher
"{026797B0-C061-4385-ACCA-F817D2C80ABF}"= UDP:c:\program files\AeriaGames\ProjectTorque\ProjectTorque.bin:Project Torqu
"{5F92DFDB-95B3-414B-9F70-F3B674EBFCF0}"= TCP:c:\program files\AeriaGames\ProjectTorque\ProjectTorque.bin:Project Torqu

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"DoNotAllowExceptions"= 0 (0x0)

R0 pavboot;pavboot;c:\windows\System32\drivers\pavboot.sys [07/01/2009 19:31 28544]
R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [03/04/2008 17:16 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [03/04/2008 17:16 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [23/02/2008 12:03 51792]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [03/08/2007 15:09 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\System32\drivers\LMIRfsDriver.sys [30/03/2008 21:26 47640]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [22/09/2008 21:47 1153368]
R3 e4usbaw;USB ADSL2 WAN Adapter;c:\windows\System32\drivers\e4usbaw.sys [23/02/2008 12:23 104344]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\System32\drivers\SiSGB6.sys [10/07/2007 22:29 46592]
S2 E4LOADER;General Purpose USB Driver (e4ldr.sys);c:\windows\System32\drivers\e4ldr.sys [23/02/2008 12:23 69656]
S3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\System32\drivers\PCAMp50.sys [23/02/2008 12:21 28224]
S3 SiS6350;SiS6350;c:\windows\System32\drivers\SISGRKMD.sys [10/07/2007 22:29 454520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
.
Contenu du dossier 'Tâches planifiées'

2008-05-17 c:\windows\Tasks\SyncBack mes docs Joëlle.job
- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [2008-05-17 13:16]

2009-06-24 c:\windows\Tasks\User_Feed_Synchronization-{909E66DD-55D9-4815-985B-640AA5492C71}.job
- c:\windows\system32\msfeedssync.exe [2009-05-08 11:31]
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-Acer Tour - (no file)
HKLM-Run-eRecoveryService - (no file)
HKLM-Run-EoEngine - (no file)

.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.fr/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://fr.fr.acer.yahoo.com
uSearchURL,(Default) = hxxp://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
IE: Compare Prices with &Dealio - c:\users\Joëlle\AppData\LocalLow\Dealio\kb125\res\DealioSearch.html
IE: Download with &Shareaza - c:\program files\Crux P2P\Plugins\RazaWebHook.dll/3000
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.zebulon.fr/scan8/oscan8.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-24 20:36
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

c:\users\JOLLE~1\AppData\Local\Temp\CabC3DA.tmp 28644 bytes
c:\users\JOLLE~1\AppData\Local\Temp\TarC3DB.tmp 65536 bytes
c:\windows\TEMP\TMP0000003AE5A953051E0FCA59 524288 bytes

Scan terminé avec succès
Fichiers cachés: 3

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'Explorer.exe'(3884)
c:\windows\system32\MsnChatHook.dll
c:\windows\system32\ShowErrMsg.dll
c:\windows\system32\sysenv.dll
c:\windows\system32\BatchCrypto.dll
c:\windows\system32\CryptoAPI.dll
c:\windows\system32\keyManager.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\System32\Ati2evxx.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\Ati2evxx.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\acer\Empowering Technology\ePerformance\MemCheck.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\acer\Empowering Technology\eMode\PCM\Kernel\TV\CLCapSvc.exe
c:\acer\Empowering Technology\eDataSecurity\eDSService.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\System32\PnkBstrA.exe
c:\windows\System32\PnkBstrB.exe
c:\program files\Cyberlink\Shared files\RichVideo.exe
c:\program files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\acer\Empowering Technology\eMode\PCM\Kernel\TV\CLSched.exe
c:\acer\Empowering Technology\eRecovery\eRecoveryService.exe
c:\windows\System32\WUDFHost.exe
c:\windows\System32\conime.exe
c:\program files\Alwil Software\Avast4\ashDisp.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
c:\acer\Empowering Technology\eRecovery\eRAgent.exe
c:\program files\LogMeIn\x86\LMIGuardian.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Internet Explorer\ielowutil.exe
.
**************************************************************************
.
Heure de fin: 2009-06-24 20:41 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-06-24 18:41

Avant-CF: 18 301 673 472 octets libres
Après-CF: 18 655 293 440 octets libres

250 --- E O F --- 2009-06-19 08:39

Execute le en tant qu'administrateur.

/!\ ATTENTION LOGICIEL TRES PUISSANT POUVANT ETRE DANGEREUX SI IL EST UTILISE ALEATOIREMENT /!\
----------------------------------------------------------------------------------------------------------------
Desactive toutes protections residentes (Antivirus, Antispyware, tea-timer de Spybot s&d...)

* Télécharge Combofix de sUBs

* Renomme-le en avril.exe

* Enregistre-le impérativement sur ton bureau

* Déconnecte-toi du net et désactive ton antivirus (juste le temps de la procédure).

* Ferme toutes les fenêtres.

* Double-clique sur avril.exe (ne clique pas sur la fenêtre qui s'ouvre).

* Appuie sur Y pour lancer le scan.

* A la fin du scan (cela peut prendre du temps), un rapport sera créé. (C:\Combofix.txt)

* Poste ce rapport dans ton / tes prochain(s) message(s).

Ca y est j'ai les 2 rapports de RSIT. Est-ce que je dois faire autre chose?

Les voili

info.txt

info.txt logfile of random's system information tool 1.06 2009-06-24 19:35:15

======Uninstall list======

-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FC4F90EC-B1DA-11D9-9D77-000129760D75}\setup.exe" -uninstall
Acer eDataSecurity Management-->C:\Acer\Empowering Technology\eDataSecurity\eDSnstHelper.exe -Operation UNINSTALL
Acer eMode Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2637C347-9DAD-11D6-9EA2-00055D0CA761}\setup.exe" -uninstall
Acer Empowering Technology-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AB6097D9-D722-4987-BD9E-A076E2848EE2}\setup.exe" -l0x40c -removeonly
Acer ePerformance Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D462BF9E-0C35-4705-BF9B-3DF9F3816643}\setup.exe" -l0x40c -removeonly
Acer ScreenSaver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}\setup.exe" -l0x9 -removeonly
Acer Tour-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{94389919-B0AA-4882-9BE8-9F0B004ECA35}\setup.exe" -l0x40c -removeonly
Activation Assistant for the 2007 Microsoft Office suites-->"C:\ProgramData\{623D32E9-0C62-4453-AD44-98B31F52A5E1}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE
Adobe Anchor Service CS3-->MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}
Adobe Asset Services CS3-->MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}
Adobe Bridge CS3-->MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}
Adobe Bridge Start Meeting-->MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}
Adobe Camera Raw 4.0-->MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}
Adobe CMaps-->MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}
Adobe Color - Photoshop Specific-->MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}
Adobe Color Common Settings-->MsiExec.exe /I{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}
Adobe Color EU Recommended Settings-->MsiExec.exe /I{73B5D990-04EA-4751-B10F-5534770B91F2}
Adobe Color JA Extra Settings-->MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}
Adobe Color NA Extra Settings-->MsiExec.exe /I{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}
Adobe Default Language CS3-->MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}
Adobe Device Central CS3-->MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}
Adobe ExtendScript Toolkit 2-->MsiExec.exe /I{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->MsiExec.exe /X{ECA1A3B6-898F-4DCE-9F04-714CF3BA126B}
Adobe Fonts All-->MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}
Adobe Help Viewer CS3-->MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}
Adobe Linguistics CS3-->MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}
Adobe PDF Library Files-->MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}
Adobe Photoshop 6.0-->C:\WINDOWS\ISUN040C.EXE -f"C:\Program Files\Adobe\Photoshop 6.0\Uninst.isu" -c"C:\Program Files\Adobe\Photoshop 6.0\Uninst.dll"
Adobe Photoshop CS3-->C:\Program Files\Common Files\Adobe\Installers\32e9033392a51340b32fdc6ad893ab7\Setup.exe
Adobe Photoshop CS3-->MsiExec.exe /I{BF794769-8875-4E01-B7BE-E00104604F4A}
Adobe Reader 8.1.3 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81300000003}
Adobe Setup-->MsiExec.exe /I{926DEB4E-2B0A-4C5C-AE4A-BF6C06949702}
Adobe Shockwave Player-->C:\Windows\System32\Macromed\SHOCKW~1\UNWISE.EXE C:\Windows\System32\Macromed\SHOCKW~1\Install.log
Adobe Stock Photos CS3-->MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}
Adobe SVG Viewer-->C:\Windows\IsUn040c.exe -f"C:\Windows\System32\Adobe\SVG Viewer\Uninst.isu"
Adobe Type Support-->MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}
Adobe Update Manager CS3-->MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}
Adobe Version Cue CS3 Client-->MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}
Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}
Adobe XMP Panels CS3-->MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}
adsl TV-->C:\Program Files\adslTV\Uninstal.exe
Age of Empires III-->C:\Program Files\InstallShield Installation Information\{70F8B183-99EB-4304-BA35-080E2DFFD2A3}\install.exe -runfromtemp -l0x040c
AssaultCube v1.0-->"C:\Program Files\AssaultCube_v1.0\uninstall.exe"
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
AVG Anti-Rootkit Free-->C:\Program Files\GRISOFT\AVG Anti-Rootkit Free\Uninstall.exe
Battlefield 2(TM) Demo-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8BECF123-B0EF-4E51-B7F3-923EFE15CC4A}\setup.exe" -l0x9 -removeonly
BitComet 1.03-->C:\Program Files\BitComet\uninst.exe
Catalyst Control Center - Branding-->MsiExec.exe /I{D3B1C799-CB73-42DE-BA0F-2344793A095C}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Clean Virus MSN-->"C:\Program Files\AxBx\Clean Virus MSN\unins000.exe"
DawnOfWar-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe /M{362D5167-9716-44BE-89FD-BF9EB6EF814B}
eSobi v2-->C:\Program Files\InstallShield Installation Information\{15D967B5-A4BE-42AE-9E84-64CD062B25AA}\setup.exe -runfromtemp -l0x040c
FEARCombat-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{75E607CF-7BAE-4B88-84B3-97F3DF44BA28}\setup.exe" -l0x9 /zU -removeonly
FileZilla Client 3.0.9.1-->C:\Program Files\FileZilla FTP Client\uninstall.exe
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_9DE96A29E721D90A.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
GUILD WARS-->"C:\Program Files\GUILD WARS\Gw.exe" -uninstall
HijackThis 2.0.2-->"S:\Docs Joëlle\Téléchargement\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
IconLover-->"C:\Program Files\IconLover\uninstall.exe"
Java(TM) 6 Update 10-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216010FF}
Java(TM) 6 Update 4-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160040}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
LG PC Suite II-->C:\Program Files\InstallShield Installation Information\{14DCD95A-EBA3-4BF0-B7EF-533852E99BE6}\setup.exe -runfromtemp -l0x040c -removeonly
LG USB Modem driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C3ABE126-2BB2-4246-BFE1-6797679B3579}\setup.exe" -l0x40c LG -removeonly
Logitech Gaming Software 5.02-->MsiExec.exe /X{64B20B36-AEE7-4DD4-897C-C5DA5C218F60}
LogMeIn-->MsiExec.exe /I{7E7658A2-CD3F-48A7-93EA-0882BCA4FD2A}
Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
Microsoft .NET Framework 3.5 SP1-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Office XP Professional avec FrontPage-->MsiExec.exe /I{9028040C-6000-11D3-8CFE-0050048383C9}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Works-->MsiExec.exe /I{6B1CB38D-E2E4-4A30-933D-EFDEBA76AD9C}
Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
NTI Backup NOW! 4.7-->"C:\Program Files\InstallShield Installation Information\{67ADE9AF-5CD9-4089-8825-55DE4B366799}\setup.exe" -removeonly
NTI CD & DVD-Maker-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2} /l1036 CDM7
Oblivion-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{35CB6715-41F8-4F99-8881-6FC75BF054B0}\setup.exe" -l0x40c -removeonly
OpenAL-->"C:\Program Files\OpenAL\oalinst.exe" /U
OpenOffice.org Installer 1.0-->MsiExec.exe /X{3A2AF807-9F9F-43C9-A24A-17B617238B74}
Panda ActiveScan 2.0-->C:\Program Files\Panda Security\ActiveScan 2.0\as2uninst.exe
PDF Settings-->MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}
PDFCreator-->C:\Program Files\PDFCreator\unins000.exe
PowerProducer-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\setup.exe" -uninstall
Project Torque-->C:\Program Files\AeriaGames\ProjectTorque\uninstall.exe
PunkBuster Services-->C:\Windows\system32\pbsvc.exe -u
Quake Live Internet Explorer Plugin-->MsiExec.exe /I{204CDC04-F831-4D6A-8F4C-DDA5B4995382}
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
Recuva (remove only)-->"C:\Program Files\Recuva\uninst.exe"
SAGEM F@st 800-840-->C:\Program Files\InstallShield Installation Information\{4AE3A0CB-87B0-4F51-BECD-3D1F8DFDD62F}\setup.exe -runfromtemp -l0x040c -removeonly
Search Settings-->MsiExec.exe /X{90529245-9C54-45B5-BBB3-B180CA04F248}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Skype™ 3.8-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
SoftwareUpdate 1.0-->"C:\Users\Benjamin\AppData\Roaming\eoRezo\SoftwareUpdate\unins000.exe"
Sophos Anti-Rootkit 1.3.1-->C:\Program Files\Sophos\Sophos Anti-Rootkit\helper.exe remove
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
SyncBack-->"C:\Program Files\2BrightSparks\SyncBack\unins000.exe"
VIA Gestionnaire de périphériques de plate-forme-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169}
VideoLAN VLC media player 0.8.6e-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Live installer-->MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
WMIDs-->MsiExec.exe /I{7DDF8195-2020-4582-A348-376F87F7C676}
Worms Armageddon-->C:\Windows\IsUninst.exe -f"c:\Team17\Worms Armageddon\Uninst.isu"
Wormux-->C:\Program Files\Wormux\uninstall.exe

======Security center information======

AV: avast! antivirus 4.8.1229 [VPS 081124-0]
AS: Spybot - Search and Destroy (disabled) (outdated)
AS: Windows Defender
AS: avast! antivirus 4.8.1229 [VPS 081124-0]

======System event log======

Computer Name: Bordeaux
Event Code: 34001
Message: ICS_IPV6 n'a pas pu configurer la pile IPv6.
Record Number: 392508
Source Name: Microsoft-Windows-SharedAccess_NAT
Time Written: 20090624145445.000000-000
Event Type: Erreur
User:

Computer Name: Bordeaux
Event Code: 31004
Message: L'agent proxy DNS n'a pas pu allouer 0 octets de mémoire. Ceci peut indiquer que le système n'a plus beaucoup de mémoire virtuelle, ou que le gestionnaire de mémoire a rencontré une erreur interne.
Record Number: 392510
Source Name: Microsoft-Windows-SharedAccess_NAT
Time Written: 20090624145510.000000-000
Event Type: Erreur
User:

Computer Name: Bordeaux
Event Code: 31004
Message: L'agent proxy DNS n'a pas pu allouer 0 octets de mémoire. Ceci peut indiquer que le système n'a plus beaucoup de mémoire virtuelle, ou que le gestionnaire de mémoire a rencontré une erreur interne.
Record Number: 392522
Source Name: Microsoft-Windows-SharedAccess_NAT
Time Written: 20090624154935.000000-000
Event Type: Erreur
User:

Computer Name: Bordeaux
Event Code: 34005
Message: Le service ICS_IPV6 n'a pas pu allouer octets de mémoire. Cela pourrait indiquer que le système n'a pas assez de mémoire virtuelle ou que le gestionnaire de mémoire a rencontré une erreur interne.
Record Number: 392525
Source Name: Microsoft-Windows-SharedAccess_NAT
Time Written: 20090624154938.000000-000
Event Type: Avertissement
User:

Computer Name: Bordeaux
Event Code: 3004
Message: L’agent de protection en temps réel Windows Defender a détecté des modifications. Microsoft vous recommande d’analyser les logiciels responsables de ces modifications, à la recherche de risques potentiels. Vous pouvez vous servir des informations relatives au fonctionnement de ces programmes pour autoriser ou non leur exécution, ou pour les supprimer de l’ordinateur. N’autorisez les modifications que si vous faites confiance au programme ou à l’éditeur de logiciel. Windows Defender ne peut pas annuler les modifications que vous autorisez.
Pour plus d’informations, consultez les données suivantes :
Non applicable
ID d’analyse : {1A9B6E43-D10A-45B7-898A-BBD533DAAC10}
Utilisateur : BORDEAUX\Joëlle
Nom : Unknown
ID :
ID de gravité :
ID de catégorie :
Chemin d’accès trouvé : file:C:\Windows\system32\drivers\etc\hosts
Type d’alerte : Logiciel non classifié
Type de détection :
Record Number: 392528
Source Name: Microsoft-Windows-Windows Defender
Time Written: 20090624165511.000000-000
Event Type: Avertissement
User:

=====Application event log=====

Computer Name: Bordeaux
Event Code: 1530
Message: Windows a détecté que votre fichier de Registre est toujours utilisé par d'autres applications ou services. Le fichier va être déchargé. Les applications ou services qui ont accès à votre Registre risquent de ne pas fonctionner correctement après cela.

DÉTAIL -
1 user registry handles leaked from \Registry\User\S-1-5-21-788108967-3940742589-920756846-1000_Classes:
Process 960 (\Device\HarddiskVolume2\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-788108967-3940742589-920756846-1000_CLASSES

Record Number: 92445
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20090624145255.000000-000
Event Type: Avertissement
User: AUTORITE NT\SYSTEM

Computer Name: Bordeaux
Event Code: 4354
Message: Le système d'événements de COM+ n'a pas pu déclencher la méthode ConnectionMadeNoQOCInfo de l'abonnement {210FE810-048B-4EC1-94C9-F88A314CBFA2}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}. L'abonné a renvoyé HRESULT 80040210.
Record Number: 92469
Source Name: Microsoft-Windows-EventSystem
Time Written: 20090624145446.000000-000
Event Type: Avertissement
User:

Computer Name: Bordeaux
Event Code: 4354
Message: Le système d'événements de COM+ n'a pas pu déclencher la méthode ConnectionMadeNoQOCInfo de l'abonnement {210FE810-048B-4EC1-94C9-F88A314CBFA2}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}. L'abonné a renvoyé HRESULT 80040210.
Record Number: 92476
Source Name: Microsoft-Windows-EventSystem
Time Written: 20090624145511.000000-000
Event Type: Avertissement
User:

Computer Name: Bordeaux
Event Code: 4354
Message: Le système d'événements de COM+ n'a pas pu déclencher la méthode ConnectionMadeNoQOCInfo de l'abonnement {210FE810-048B-4EC1-94C9-F88A314CBFA2}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}. L'abonné a renvoyé HRESULT 80040210.
Record Number: 92481
Source Name: Microsoft-Windows-EventSystem
Time Written: 20090624153304.000000-000
Event Type: Avertissement
User:

Computer Name: Bordeaux
Event Code: 4354
Message: Le système d'événements de COM+ n'a pas pu déclencher la méthode ConnectionMadeNoQOCInfo de l'abonnement {210FE810-048B-4EC1-94C9-F88A314CBFA2}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}. L'abonné a renvoyé HRESULT 80040210.
Record Number: 92482
Source Name: Microsoft-Windows-EventSystem
Time Written: 20090624154934.000000-000
Event Type: Avertissement
User:

=====Security event log=====

Computer Name: Bordeaux
Event Code: 4624
Message: L’ouverture de session d’un compte s’est correctement déroulée.

Sujet :
ID de sécurité : S-1-5-18
Nom du compte : BORDEAUX$
Domaine du compte : VILLACLARA
ID d’ouverture de session : 0x3e7

Type d’ouverture de session : 2

Nouvelle ouverture de session :
ID de sécurité : S-1-5-21-788108967-3940742589-920756846-1001
Nom du compte : Benjamin
Domaine du compte : BORDEAUX
ID d’ouverture de session : 0x3e9184
GUID d’ouverture de session : {00000000-0000-0000-0000-000000000000}

Informations sur le processus :
ID du processus : 0x1080
Nom du processus : C:\Windows\System32\winlogon.exe

Informations sur le réseau :
Nom de la station de travail : BORDEAUX
Adresse du réseau source : 127.0.0.1
Port source : 0

Informations détaillées sur l’authentification :
Processus d’ouverture de session : User32
Package d’authentification : Negotiate
Services en transit : -
Nom du package (NTLM uniquement) : -
Longueur de la clé : 0

Cet événement est généré lors de la création d’une ouverture de session. Il est généré sur l’ordinateur sur lequel l’ouverture de session a été effectuée.

Le champ Objet indique le compte sur le système local qui a demandé l’ouverture de session. Il s’agit le plus souvent d’un service, comme le service Serveur, ou un processus local tel que Winlogon.exe ou Services.exe.

Le champ Type d’ouverture de session indique le type d’ouverture de session qui s’est produit. Les types les plus courants sont 2 (interactif) et 3 (réseau).

Le champ Nouvelle ouverture de session indique le compte pour lequel la nouvelle ouverture de session a été créée, par exemple, le compte qui s’est connecté.

Les champs relatifs au réseau indiquent la provenance d’une demande d’ouverture de session à distance. Le nom de la station de travail n’étant pas toujours disponible, peut être laissé vide dans certains cas.

Les champs relatifs aux informations d’authentification fournissent des détails sur cette demande d’ouverture de session spécifique.
- Le GUID d’ouverture de session est un identificateur unique pouvant servir à associer cet événement à un événement KDC .
- Les services en transit indiquent les services intermédiaires qui ont participé à cette demande d’ouverture de session.
- Nom du package indique quel est le sous-protocole qui a été utilisé parmi les protocoles NTLM.
- La longueur de la clé indique la longueur de la clé de session générée. Elle a la valeur 0 si aucune clé de session n’a été demandée.
Record Number: 83379
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090313233819.203601-000
Event Type: Succès de l'audit
User:

Computer Name: Bordeaux
Event Code: 4672
Message: Privilèges spéciaux attribués à la nouvelle ouverture de session.

Sujet :
ID de sécurité : S-1-5-21-788108967-3940742589-920756846-1001
Nom du compte : Benjamin
Domaine du compte : BORDEAUX
ID d’ouverture de session : 0x3e915f

Privilèges : SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
Record Number: 83380
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090313233819.203601-000
Event Type: Succès de l'audit
User:

Computer Name: Bordeaux
Event Code: 5038
Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier : \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 83381
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090313233906.482001-000
Event Type: Échec de l'audit
User:

Computer Name: Bordeaux
Event Code: 5038
Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier : \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 83382
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090313233906.544401-000
Event Type: Échec de l'audit
User:

Computer Name: Bordeaux
Event Code: 5038
Message: L’intégrité du code a déterminé que le hachage de l’image d’un fichier n’est pas valide. Le fichier peut être endommagé en raison d’une modification non autorisée ou le hachage non valide peut indiquer une erreur d’unité de disque potentielle.

Nom du fichier : \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys
Record Number: 83383
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090313233906.638001-000
Event Type: Échec de l'audit
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
"PROCESSOR_REVISION"=0f0d
"NUMBER_OF_PROCESSORS"=2

-----------------EOF-----------------

log.txt

Logfile of random's system information tool 1.06 (written by random/random)
Run by Joëlle at 2009-06-24 19:34:53
Microsoft® Windows Vista™ Édition Familiale Basique Service Pack 1
System drive C: has 12 GB (17%) free of 71 GB
Total RAM: 2047 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:35:11, on 24/06/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Users\Benjamin\AppData\Roaming\EoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Acer\Empowering Technology\SysMonitor.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Acer\Empowering Technology\eMode\PCM\PCMService.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\Program Files\Logitech\Gaming Software\LWEMon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\system32\conime.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
S:\Docs Joëlle\Bureau\RSIT.exe
S:\Docs Joëlle\Téléchargement\Joëlle.exe
C:\Windows\system32\msfeedssync.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - (no file)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.6.26.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb125\SearchSettings.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [PCMService] "C:\Acer\Empowering Technology\eMode\PCM\PCMService.exe"
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"
O4 - HKLM\..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\RunOnce: [SoftwareHelper] C:\Users\Benjamin\AppData\Roaming\EoRezo\SoftwareUpdate\SoftwareUpdateHP.exe -runonce
O4 - HKCU\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [LESS CITY AMEN SETUP] "C:\ProgramData\SOFTWARE STOP CAKE.74ni4dy"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Compare Prices with &Dealio - C:\Users\Joëlle\AppData\LocalLow\Dealio\kb125\res\DealioSearch.html
O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Crux P2P\Plugins\RazaWebHook.dll/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.6.26.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.zebulon.fr/outils/antivirus/kavwebscan_unicode.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://www.pandasecurity.com/activescan/cabs/as2stubie.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F62E8F2F-3055-4126-BC59-25848416FAA0}: NameServer = 80.10.246.1 81.253.149.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLSched.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\Cyberlink\Shared files\RichVideo.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

Pas trop faim ou tu manges en même temps ?

Le deuxième est en cours

Voilà le premier rapport

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Basique ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Pentium(R) Dual CPU E2140 @ 1.60GHz )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : Joëlle ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1229 [VPS 081124-0] 4.8.1229 (Activated)
C:\ (Local Disk) - NTFS - Total:69 Go (Free:11 Go)
D:\ (Local Disk) - NTFS - Total:69 Go (Free:47 Go)
E:\ (CD or DVD)
F:\ (USB)
G:\ (USB)
H:\ (USB)
I:\ (USB)
J:\ (CD or DVD)
S:\ (Local Disk) - NTFS - Total:465 Go (Free:369 Go)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [2] ( 24/06/2009|18:55 )

[ UAC => 1 ]

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

Supprime! - C:\Users\JOLLE~1\AppData\Roaming\MICROS~1\Windows\Cookies\joëlle@advertising[2].txt
Supprime! - C:\ProgramData\freetranstrans.cnz29
Supprime! - C:\ProgramData\freetranstrans.ink2v
Supprime! - C:\ProgramData\freetranstrans.5jdbbi
Supprime! - C:\ProgramData\freetranstrans.jn8w70s
Supprime! - C:\ProgramData\Tool Eggs Less City
-
[ Fichier Hosts ] .. Restaure!

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

--------------------\\ Listing des dossiers dans Local

[28/01/2009|15:36] C:\Users\JOLLE~1\AppData\Local\Adobe
[20/02/2008|22:19] C:\Users\JOLLE~1\AppData\Local\Application Data
[20/02/2008|22:20] C:\Users\JOLLE~1\AppData\Local\ATI
[08/04/2008|21:00] C:\Users\JOLLE~1\AppData\Local\d3d9caps.dat
[24/06/2009|18:38] C:\Users\JOLLE~1\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[23/08/2008|15:01] C:\Users\JOLLE~1\AppData\Local\free-downloads.net
[02/01/2009|21:05] C:\Users\JOLLE~1\AppData\Local\GDIPFONTCACHEV1.DAT
[09/06/2009|15:21] C:\Users\JOLLE~1\AppData\Local\Google
[20/02/2008|22:19] C:\Users\JOLLE~1\AppData\Local\Historique
[24/06/2009|16:52] C:\Users\JOLLE~1\AppData\Local\IconCache.db
[01/08/2008|14:35] C:\Users\JOLLE~1\AppData\Local\LogMeIn
[30/03/2009|18:50] C:\Users\JOLLE~1\AppData\Local\Microsoft
[21/02/2008|14:26] C:\Users\JOLLE~1\AppData\Local\Microsoft Games
[26/05/2009|16:44] C:\Users\JOLLE~1\AppData\Local\Mozilla
[11/03/2009|20:59] C:\Users\JOLLE~1\AppData\Local\PowerCinema
[25/02/2008|01:36] C:\Users\JOLLE~1\AppData\Local\PunkBuster
[24/06/2009|18:55] C:\Users\JOLLE~1\AppData\Local\Temp
[20/02/2008|22:19] C:\Users\JOLLE~1\AppData\Local\Temporary Internet Files
[28/02/2008|14:16] C:\Users\JOLLE~1\AppData\Local\VirtualStore

--------------------\\ Tâches planifiées dans C:\Windows\tasks

[17/05/2008 21:06][--a------] C:\Windows\tasks\SyncBack mes docs Jo‰lle.job
[24/06/2009 18:55][--ah-----] C:\Windows\tasks\User_Feed_Synchronization-{909E66DD-55D9-4815-985B-640AA5492C71}.job
[24/06/2009 16:54][--ah-----] C:\Windows\tasks\SA.DAT
[24/06/2009 16:53][--a------] C:\Windows\tasks\SCHEDLGU.TXT

--------------------\\ Listing des dossiers dans C:\ProgramData

[10/07/2007|14:11] C:\ProgramData\{623D32E9-0C62-4453-AD44-98B31F52A5E1}
[04/06/2009|21:00] C:\ProgramData\Adobe
[11/01/2009|19:05] C:\ProgramData\Age of Empires 3
[02/11/2006|14:59] C:\ProgramData\Application Data
[20/01/2009|22:50] C:\ProgramData\ATI
[16/05/2008|10:35] C:\ProgramData\BOONTY
[20/02/2008|22:15] C:\ProgramData\Bureau
[05/12/2008|22:39] C:\ProgramData\CanonBJ
[28/02/2008|13:31] C:\ProgramData\CyberLink
[02/11/2006|14:59] C:\ProgramData\Desktop
[02/11/2006|14:59] C:\ProgramData\Documents
[20/02/2008|23:02] C:\ProgramData\eSobi
[06/05/2008|22:02] C:\ProgramData\ezsidmv.dat
[20/02/2008|22:15] C:\ProgramData\Favoris
[02/11/2006|14:59] C:\ProgramData\Favorites
[18/11/2008|19:39] C:\ProgramData\flaw bits cash
[17/01/2009|13:20] C:\ProgramData\Google
[03/04/2009|01:59] C:\ProgramData\id Software
[25/11/2008|12:24] C:\ProgramData\InstallShield
[25/08/2008|12:49] C:\ProgramData\Lavasoft
[01/08/2008|14:35] C:\ProgramData\LogMeIn
[20/02/2008|22:15] C:\ProgramData\Menu D‚marrer
[30/03/2009|18:50] C:\ProgramData\Microsoft
[28/02/2008|13:25] C:\ProgramData\Microsoft Help
[20/02/2008|22:15] C:\ProgramData\ModŠles
[10/05/2008|11:28] C:\ProgramData\Skype
[15/12/2008|08:15] C:\ProgramData\Spybot - Search & Destroy
[02/11/2006|14:59] C:\ProgramData\Start Menu
[20/02/2008|22:49] C:\ProgramData\Symantec
[02/11/2006|14:59] C:\ProgramData\Templates
[10/04/2008|16:09] C:\ProgramData\WLInstaller

--------------------\\ Listing des dossiers dans C:\Program Files

[17/05/2008|21:04] C:\Program Files\2BrightSparks
[13/12/2007|18:58] C:\Program Files\Acer Inc
[10/07/2007|14:11] C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
[04/06/2009|21:00] C:\Program Files\Adobe
[02/02/2009|02:16] C:\Program Files\adslTV
[27/01/2009|18:47] C:\Program Files\AeriaGames
[20/08/2008|12:46] C:\Program Files\Alcohol Soft
[23/02/2008|12:03] C:\Program Files\Alwil Software
[20/04/2009|00:57] C:\Program Files\AssaultCube_v1.0
[20/01/2009|22:39] C:\Program Files\ATI
[20/01/2009|22:49] C:\Program Files\ATI Technologies
[10/04/2008|18:55] C:\Program Files\AxBx
[15/12/2008|22:02] C:\Program Files\Bethesda Softworks
[20/04/2009|00:57] C:\Program Files\BitComet
[02/01/2009|20:43] C:\Program Files\Bonjour
[17/09/2008|23:15] C:\Program Files\Borland
[04/12/2008|20:16] C:\Program Files\Canon
[04/12/2008|20:00] C:\Program Files\CanonBJ
[09/10/2008|19:34] C:\Program Files\CCleaner
[28/03/2009|14:10] C:\Program Files\Common Files
[19/10/2008|21:00] C:\Program Files\Conduit
[04/03/2008|18:00] C:\Program Files\Crux P2P
[10/07/2007|14:38] C:\Program Files\Cyberlink
[04/07/2008|12:46] C:\Program Files\directx
[10/07/2007|14:28] C:\Program Files\eSobi
[21/04/2009|02:03] C:\Program Files\Euro Gunz v8.5.7
[20/02/2008|22:15] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
[17/04/2008|22:06] C:\Program Files\FileZilla FTP Client
[27/03/2009|03:15] C:\Program Files\Free Download Manager
[19/10/2008|21:00] C:\Program Files\free-downloads.net
[08/09/2008|15:16] C:\Program Files\GameSpy Arcade
[17/01/2009|14:44] C:\Program Files\Google
[02/02/2009|21:39] C:\Program Files\gPotato
[25/11/2008|12:15] C:\Program Files\gPotato.eu
[08/05/2008|20:23] C:\Program Files\GRISOFT
[09/11/2008|19:44] C:\Program Files\GTA3Mods
[22/02/2009|20:05] C:\Program Files\GUILD WARS
[15/04/2009|16:25] C:\Program Files\IconLover
[30/03/2009|18:54] C:\Program Files\InstallShield Installation Information
[11/06/2009|13:39] C:\Program Files\Internet Explorer
[05/12/2008|23:03] C:\Program Files\IrfanView
[04/12/2008|18:34] C:\Program Files\Java
[22/09/2008|17:16] C:\Program Files\Lavasoft
[24/12/2008|13:36] C:\Program Files\LG Electronics
[15/01/2009|14:48] C:\Program Files\LG PC Suite II
[08/02/2009|20:15] C:\Program Files\LimeWire
[09/11/2008|19:07] C:\Program Files\Logitech
[30/01/2009|21:44] C:\Program Files\LogMeIn
[23/04/2009|02:11] C:\Program Files\MAIET
[24/02/2008|12:27] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[11/01/2009|18:47] C:\Program Files\Microsoft Games
[12/03/2008|21:07] C:\Program Files\Microsoft Office
[11/06/2009|13:22] C:\Program Files\Microsoft Works
[09/11/2008|17:08] C:\Program Files\Movie Maker
[27/05/2009|12:41] C:\Program Files\Mozilla Firefox
[02/11/2006|14:35] C:\Program Files\MSBuild
[24/02/2008|12:16] C:\Program Files\MSXML 4.0
[10/07/2007|14:33] C:\Program Files\NewTech Infosystems
[17/03/2009|20:55] C:\Program Files\Oblivion
[19/01/2009|04:20] C:\Program Files\OpenAL
[12/03/2008|19:01] C:\Program Files\Orange HSS
[07/01/2009|19:31] C:\Program Files\Panda Security
[27/12/2008|16:45] C:\Program Files\PDFCreator
[04/02/2009|02:32] C:\Program Files\Perfect World France
[05/12/2008|22:56] C:\Program Files\PhotoFiltre
[10/07/2007|14:01] C:\Program Files\Realtek
[08/06/2009|12:18] C:\Program Files\Recuva
[02/11/2006|14:35] C:\Program Files\Reference Assemblies
[25/04/2008|18:12] C:\Program Files\RomStation
[23/02/2008|12:23] C:\Program Files\SAGEM
[03/03/2008|23:10] C:\Program Files\Search Settings
[23/02/2008|12:21] C:\Program Files\Securitoo
[10/05/2008|11:28] C:\Program Files\Skype
[07/06/2008|17:58] C:\Program Files\Softnyx
[08/07/2008|19:19] C:\Program Files\Sophos
[13/04/2009|16:53] C:\Program Files\Spybot - Search & Destroy
[20/03/2009|01:54] C:\Program Files\Stardock
[20/08/2008|12:13] C:\Program Files\Sun
[20/08/2008|16:22] C:\Program Files\THQ
[02/10/2008|17:49] C:\Program Files\Ubisoft
[02/11/2006|14:58] C:\Program Files\Uninstall Information
[30/03/2009|18:53] C:\Program Files\VIA
[10/03/2008|18:25] C:\Program Files\VideoLAN
[09/11/2008|17:08] C:\Program Files\Windows Calendar
[09/11/2008|17:08] C:\Program Files\Windows Collaboration
[09/11/2008|17:08] C:\Program Files\Windows Defender
[10/04/2008|16:16] C:\Program Files\Windows Live
[14/05/2009|11:29] C:\Program Files\Windows Mail
[19/05/2009|15:59] C:\Program Files\Windows Media Player
[20/02/2008|22:15] C:\Program Files\Windows NT
[09/11/2008|17:08] C:\Program Files\Windows Photo Gallery
[09/11/2008|17:08] C:\Program Files\Windows Sidebar
[10/11/2008|13:49] C:\Program Files\WinRAR
[30/03/2008|21:46] C:\Program Files\WMIDs
[19/01/2009|03:31] C:\Program Files\Wormux
[28/02/2008|13:49] C:\Program Files\Yahoo!

--------------------\\ Listing des dossiers dans C:\Program Files\Common Files

[04/06/2009|21:00] C:\Program Files\Common Files\Adobe
[16/05/2008|10:35] C:\Program Files\Common Files\BOONTY Shared
[28/02/2008|13:37] C:\Program Files\Common Files\Designer
[23/02/2008|12:18] C:\Program Files\Common Files\France Telecom
[25/11/2008|12:39] C:\Program Files\Common Files\INCA Shared
[25/11/2008|12:15] C:\Program Files\Common Files\InstallShield
[04/03/2008|18:01] C:\Program Files\Common Files\Java
[10/07/2007|14:32] C:\Program Files\Common Files\LightScribe
[09/11/2008|19:07] C:\Program Files\Common Files\Logitech
[02/01/2009|20:34] C:\Program Files\Common Files\Macrovision Shared
[17/03/2009|04:01] C:\Program Files\Common Files\microsoft shared
[10/07/2007|14:32] C:\Program Files\Common Files\muvee Technologies
[10/07/2007|14:33] C:\Program Files\Common Files\NewTech Infosystems
[02/11/2006|13:18] C:\Program Files\Common Files\Services
[10/05/2008|11:28] C:\Program Files\Common Files\Skype
[02/11/2006|13:18] C:\Program Files\Common Files\SpeechEngines
[20/02/2008|22:51] C:\Program Files\Common Files\Symantec Shared
[09/11/2008|17:08] C:\Program Files\Common Files\System
[10/04/2008|16:16] C:\Program Files\Common Files\WindowsLiveInstaller

--------------------\\ Process

( 76 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-24 18:55:21
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden files ...
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BF5BS6KP\24-member[1].png 579 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BF5BS6KP\lg-bookmark-en[1].gif 637 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BF5BS6KP\line[1].gif 46 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BF5BS6KP\Login[1].action 7526 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BF5BS6KP\loupe2[1].gif 172 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BF5BS6KP\amex[1].png 2873 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BF5BS6KP\ga[1].js 22775 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BF5BS6KP\hr_blue[1].gif 86 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BF5BS6KP\icones_etats_stocks_v2_1[1].gif 1408 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BF5BS6KP\jquery.min[1].js 57254 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RULCT7EU\campagneJuin_300x250[1].swf 45116 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RULCT7EU\cf093cf195c25c8f6cef92e80510603f[1].png 7272 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RULCT7EU\cf7f25600b48d2aaa2c5d3b1c2ceb142[1].png 2414 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RULCT7EU\b6c12c2126b0d650d795df48db1c4961[1].png 1390 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RULCT7EU\ico_check[1].gif 1175 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RULCT7EU\ico_write_sms[1].gif 1019 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RULCT7EU\iframe2[1].js 12148 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RULCT7EU\8cf5e5d47279252dcee9671618c93bf3[1].png 4100 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RULCT7EU\920dae77523b6471df9fd6deb0c7dfb7[1].png 3704 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RULCT7EU\blt[1].js 1177 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RULCT7EU\tetiere_inscription_haut[1].png 8724 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RULCT7EU\separ_horizontal[1].png 190 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RULCT7EU\OngletFondR[1].gif 781 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RULCT7EU\OngletLeft_on[1].gif 353 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RULCT7EU\ongletmilieu[1].png 163 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RULCT7EU\OngletRight_off[1].gif 2788 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RULCT7EU\02_actu[1].png 488 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RULCT7EU\03_administration[1].png 702 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RULCT7EU\10_emploi[1].png 556 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RULCT7EU\11_pagesjaunes[1].png 879 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\myspace[1].gif 588 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\contact[1].gif 227 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\contact_mini[1].gif 488 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\160609_SG_SoMucic_300x250-M3[1].swf 49940 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\final_1720[1].jpg 14584 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\fleche_logiciel[1].gif 132 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\fond_message_comm70[1].gif 824 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\abonnement_newsletter[1].gif 326 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\telechargement_FlyOver_Floating_1x1;tile=4;kw=null;nat=fichewindows;theme=pc;sousrub=outilssysteme;prehome=1;dcopt=ist;sz=1x1;ord=4072058222187691[1].5 234 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\tel_fiche_dl_points[1].gif 43 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\letudiant_bac2009_728[1].swf 15147 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\light[1].gif 104 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\logiciel-contact-light[1].gif 873 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\pixmania-clubic[1].css 2610 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\plugin_overdraw[1].js 2293 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\plugin_thickbox[1].js 16671 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\produit7_photo2_1001[1].gif 2816 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\avatar_defaut_mini[1].gif 1244 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\33029[1].gif 7221 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\42210[1].gif 5349 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\44137[1].gif 5489 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\4666_fr_sm[1].jpg 7150 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\48384[1].gif 5434 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\h_tel_dl_small[1].jpg 1316 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\h_tel_ico_internet[1].jpg 760 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\h_tel_ico_jeux[1].jpg 585 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\h_tel_logo-microsoft[1].png 2730 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\h_tel_ombre[1].gif 50 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\h_tel_onglet_t1_off[1].png 798 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\h_tel_onglet_t2_off[1].png 1178 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\h_tel_ongl_f[1].png 205 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\h_tel_ongl_inter[1].gif 43 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\h_tel_points[1].gif 44 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\onglet_AF_off[1].gif 1624 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\onglet_dl_telephone-mobile_off[1].gif 466 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\onglet_dl_windows_on[1].gif 569 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\onglet_menu_on_gauche[1].gif 173 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\ongle_hightech_droite[1].gif 169 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\rouge[1].gif 237 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\rss[2].gif 687 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\FR_football_300x150[1].swf 17404 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ8XL7K4\angle_gauche_titre[1].gif 191 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\dialog-error[1].png
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\checkboxs[1].css
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\inscription[1].css
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\footer_hp[1].gif
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\tetiere_inscription_bas[1].png
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\ongletdroit[1].png
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\120_swhitecloud_sun[1].gif 6589 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\285085197720[1].gif 45 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\nav_logo4[1].png 7121 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\ap_logo_quidonc[1].gif 1206 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\aquiestcenumero.do;jsessionid=F29CFAB9AF70A237B9343CABA37541AF[1].htm 46460 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\aquiestcenumero[1].htm 42590 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\arc[1].jpg 14144 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\favicon[1].ico 1406 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\favicon[2].ico 1406 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\pagesBlanches[1].css 20748 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\sbx_services_LR_quidonc[1].css 5388 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\scriptCommun[1].js 17248 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\script_carte_voeux[1].js 883 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\script_open[1].js 10233 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\script_quiDonc[1].js 12741 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\search[3]
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\sep_mesliens[1].gif 335 bytes
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\startdownload_Megabanniere_Top_728x90;tile=1;kw=null;nat=null;theme=null;sousrub=outilssysteme;sz=728x90;ord=288225557385243[1].8
C:\Users\JOLLE~1\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZSFWYUU4\ajax[1].js 1988 bytes
scan completed successfully
hidden processes: 0
hidden files: 97

--------------------\\ Recherche d'autres infections

Aucune autre infection trouvée !

[F:119][D:469]-> C:\Users\JOLLE~1\AppData\Local\Temp
[F:860][D:1]-> C:\Users\JOLLE~1\AppData\Roaming\MICROS~1\Windows\Cookies
[F:73637][D:4]-> C:\Users\JOLLE~1\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
[F:80][D:76]-> C:\$Recycle.Bin

1 - "C:\Lop SD\LopR_1.txt" - 24/06/2009|17:35 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 24/06/2009|19:30 - Option : [2]

--------------------\\ Fin du rapport a 19:30:26
[ UAC => 1 ]

Pas de probleme ;-)

Ca y est j'ai lancé la suppression avec LopSD il y a 5 minutes. Je te poste le rapport des qu'il est là.