HELP: ordinateur infecté par virus !

lylas31 -  
Bonjour,

Mon ordinateur ( système : Microsoft windows XP Version 2002 ) est infecté de virus (selon rapport Avast il s'agirait entre autre de Kelvir, cutwail, BHO-VX Fakealert-AT , Hybris rootkit, etc...)
Je ne sais pas du tout comment les éliminer .
Vous trouverez ci-dessous le contenu des rapports log.txt et info.txt générés par RSIT

Merci d'avance pour votre aide

------------------------------------------------------
log.txt
---------------------------------------------------------
Logfile of random's system information tool 1.06 (written by random/random)
Run by Pascal at 2009-07-15 18:27:16
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 46 GB (35%) free of 131 GB
Total RAM: 2047 MB (34% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:27:28, on 15/07/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Winsudate\gibsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEFE.EXE
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Winsudate\gibusr.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Logitech\Gaming Software\LWEMon.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
F:\DRIVERS\RSIT.exe
C:\Program Files\trend micro\Pascal.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Regedit32] C:\WINDOWS\system32\regedit.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus SX200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEFE.EXE /FU "C:\WINDOWS\TEMP\E_S66.tmp" /EF "HKCU"
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [WinUsr] C:\Program Files\Winsudate\gibusr.exe
O4 - HKCU\..\Run: [Pascal] C:\Documents and Settings\Pascal.ADMIN.000\Pascal.ADMIN.000.exe /i
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Nikon Monitor.lnk = ?
O4 - Startup: rncsys32.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
O23 - Service: Service Google Update (gupdate1c9e6032e0728a2) (gupdate1c9e6032e0728a2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Gestionnaire de mise à jour Winsudate (WinSvc) - Winsudate - C:\Program Files\Winsudate\gibsvc.exe

--
End of file - 18870 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\At1.job
C:\WINDOWS\tasks\At10.job
C:\WINDOWS\tasks\At11.job
C:\WINDOWS\tasks\At12.job
C:\WINDOWS\tasks\At13.job
C:\WINDOWS\tasks\At14.job
C:\WINDOWS\tasks\At15.job
C:\WINDOWS\tasks\At16.job
C:\WINDOWS\tasks\At17.job
C:\WINDOWS\tasks\At18.job
C:\WINDOWS\tasks\At19.job
C:\WINDOWS\tasks\At2.job
C:\WINDOWS\tasks\At20.job
C:\WINDOWS\tasks\At21.job
C:\WINDOWS\tasks\At22.job
C:\WINDOWS\tasks\At23.job
C:\WINDOWS\tasks\At24.job
C:\WINDOWS\tasks\At3.job
C:\WINDOWS\tasks\At4.job
C:\WINDOWS\tasks\At5.job
C:\WINDOWS\tasks\At6.job
C:\WINDOWS\tasks\At7.job
C:\WINDOWS\tasks\At8.job
C:\WINDOWS\tasks\At9.job
C:\WINDOWS\tasks\Google Software Updater.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]
&Yahoo! Toolbar Helper - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [2008-07-28 882416]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Aide pour le lien d'Adobe PDF Reader - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2009-06-05 312928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}]
EoBho Class - C:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-11-10 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Programme d'aide de l'Assistant de connexion Windows Live - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-06-13 259696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll [2009-03-24 668656]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll [2009-04-27 470512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-11-10 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-11-10 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}]
EpsonToolBandKicker Class - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2005-02-21 368640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDAD4DA1-61A2-4FD8-9C17-86F7AC245081}]
SingleInstance Class - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll [2008-07-28 160496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EE5D279F-081B-4404-994D-C6B60AAEBA6D} - EPSON Web-To-Page - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2005-02-21 368640]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-06-13 259696]
{EF99BD32-C1FB-11D2-892F-0090271D4F88} - Yahoo! Toolbar - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll [2008-07-28 882416]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-02-05 81000]
"Start WingMan Profiler"=C:\Program Files\Logitech\Gaming Software\LWEMon.exe [2008-04-04 88584]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]
"RemoteControl"=C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2003-10-31 32768]
"InCD"=C:\Program Files\Ahead\InCD\InCD.exe [2004-02-18 1265783]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-11-10 136600]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-01-05 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-04-02 342312]
"TkBellExe"=C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe [2009-06-05 198160]
"Regedit32"=C:\WINDOWS\system32\regedit.exe []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-03-28 68856]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-08-05 15360]
"EPSON Stylus SX200 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEFE.EXE [2007-12-13 188928]
"AlcoholAutomount"=C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe [2008-11-23 203720]
"PC Suite Tray"=C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe [2008-12-03 1205760]
"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe [2009-04-23 691656]
"WinUsr"=C:\Program Files\Winsudate\gibusr.exe [2009-07-07 63216]
"Pascal"=C:\Documents and Settings\Pascal.ADMIN.000\Pascal.ADMIN.000.exe [2009-07-10 40448]

C:\Documents and Settings\All Users.WINDOWS\Menu Démarrer\Programmes\Démarrage
KODAK Software Updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
Logiciel Kodak EasyShare.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Documents and Settings\Pascal.ADMIN.000\Menu Démarrer\Programmes\Démarrage
Nikon Monitor.lnk - C:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
rncsys32.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2007-05-18 118784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LBTWlgn]
c:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll [2008-05-02 72208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WdfLoadGroup]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"F:\EA GAMES\Battlefield 2\BF2.exe"="F:\EA GAMES\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\Program Files\Orange\Connectivity\ConnectivityManager.exe"="C:\Program Files\Orange\Connectivity\ConnectivityManager.exe:*:Disabled:CSS"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Xfire\xfire.exe"="C:\Program Files\Xfire\xfire.exe:*:Disabled:Xfire"
""=""
"C:\DOCUME~1\Ava\LOCALS~1\Temp\services.exe"="C:\DOCUME~1\Ava\LOCALS~1\Temp\services.exe:*:Enabled:Flash Media"
"C:\Program Files\MotoGP2\motogp2.exe"="C:\Program Files\MotoGP2\motogp2.exe:*:Enabled:motogp2"
"C:\Program Files\Ankama Games\DofusArenaBeta2\DofusArena.exe"="C:\Program Files\Ankama Games\DofusArenaBeta2\DofusArena.exe:*:Enabled:Dofus Arena Client"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\Program Files\EA GAMES\Battlefield 2\BF2.exe"="C:\Program Files\EA GAMES\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2"
"C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe"="C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe:*:Disabled:Kodak Software Updater"
"C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe"="C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare"
"C:\Program Files\Atari\Act of War - Direct Action\ACTOFWAR.EXE"="C:\Program Files\Atari\Act of War - Direct Action\ACTOFWAR.EXE:*:Enabled:ACTOFWAR"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Documents and Settings\Valentin.ADMIN.000\Local Settings\Temporary Internet Files\Content.IE5\DCMVRR1K\9Dragons_downloader_us_6-20-2008[1].exe"="C:\Documents and Settings\Valentin.ADMIN.000\Local Settings\Temporary Internet Files\Content.IE5\DCMVRR1K\9Dragons_downloader_us_6-20-2008[1].exe:*:Enabled:9Dragons Downloader"
"C:\Program Files\Metin2_France\metin2.bin"="C:\Program Files\Metin2_France\metin2.bin:*:Enabled:metin2"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\EA GAMES\MOHDA\MOHAA.exe"="C:\Program Files\EA GAMES\MOHDA\MOHAA.exe:*:Enabled:Medal of Honor Allied Assault(tm)"
"C:\Program Files\EA GAMES\MOHDA\moh_spearhead.exe"="C:\Program Files\EA GAMES\MOHDA\moh_spearhead.exe:*:Disabled:Medal of Honor Allied Assault(tm) Spearhead"
"C:\Program Files\EA GAMES\MOHDA\moh_Breakthrough.exe"="C:\Program Files\EA GAMES\MOHDA\moh_Breakthrough.exe:*:Disabled:Medal of Honor Allied Assault(tm) Breakthrough"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Ubisoft\Prince of Persia\Prince of Persia.exe"="C:\Program Files\Ubisoft\Prince of Persia\Prince of Persia.exe:*:Enabled:Prince of Persia Dx"
"C:\Program Files\Ubisoft\Prince of Persia\PrinceOfPersia_Launcher.exe"="C:\Program Files\Ubisoft\Prince of Persia\PrinceOfPersia_Launcher.exe:*:Enabled:Prince of Persia Update"
"C:\Program Files\Vuze\Azureus.exe"="C:\Program Files\Vuze\Azureus.exe:*:Disabled:Azureus"
"C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe"="C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM)"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{62f011c6-c44f-11dd-9146-001d60911cb4}]
shell\AutoRun\command - H:\WDSetup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{97f68166-f753-11dd-919e-001d60911cb4}]
shell\AutoRun\command - G:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aa48b0cf-f3a2-11dd-919a-001d60911cb4}]
shell\AutoRun\command - H:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aa48b0d0-f3a2-11dd-919a-001d60911cb4}]
shell\AutoRun\command - H:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f6c6e3b4-d4cf-11dd-9161-001d60911cb4}]
shell\Auto\command - cmd /C launch.bat
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL cmd /C launch.bat

======List of files/folders created in the last 1 months======

2009-07-15 18:27:17 ----D---- C:\Program Files\trend micro
2009-07-15 18:27:16 ----D---- C:\rsit
2009-07-15 18:05:40 ----D---- C:\Documents and Settings\Pascal.ADMIN.000\Application Data\Yahoo!
2009-07-15 18:05:35 ----D---- C:\Program Files\CCleaner
2009-07-10 16:04:27 ----D---- C:\Program Files\wletmin
2009-07-10 14:33:06 ----D---- C:\Documents and Settings\Pascal.ADMIN.000\Application Data\InstallShield Installation Information
2009-07-07 20:32:50 ----D---- C:\Program Files\Winsudate
2009-07-07 20:32:50 ----D---- C:\Program Files\Letmin
2009-07-07 20:32:50 ----D---- C:\Documents and Settings\Pascal.ADMIN.000\Application Data\Icones
2009-06-27 19:10:56 ----A---- C:\WINDOWS\system32\mcdvd_32.dll
2009-06-27 17:50:48 ----D---- C:\Documents and Settings\Pascal.ADMIN.000\Application Data\AVS4YOU
2009-06-27 17:50:45 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\AVS4YOU
2009-06-27 17:50:11 ----D---- C:\Program Files\Fichiers communs\AVSMedia
2009-06-27 17:50:11 ----A---- C:\WINDOWS\system32\GdiPlus.dll
2009-06-27 17:50:10 ----D---- C:\Program Files\AVS4YOU

======List of files/folders modified in the last 1 months======

2009-07-15 18:27:17 ----RD---- C:\Program Files
2009-07-15 18:27:16 ----D---- C:\WINDOWS\Prefetch
2009-07-15 18:16:01 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo! Companion
2009-07-15 18:12:58 ----D---- C:\WINDOWS\Minidump
2009-07-15 18:12:58 ----D---- C:\WINDOWS\Debug
2009-07-15 18:12:58 ----D---- C:\WINDOWS
2009-07-15 18:12:57 ----D---- C:\WINDOWS\Temp
2009-07-15 17:57:35 ----SD---- C:\WINDOWS\Tasks
2009-07-15 12:00:00 ----N---- C:\WINDOWS\SchedLgU.Txt
2009-07-15 09:38:01 ----D---- C:\WINDOWS\system32\inetsrv
2009-07-14 19:33:33 ----D---- C:\WINDOWS\system32\drivers
2009-07-14 09:32:14 ----D---- C:\Documents and Settings\All Users.WINDOWS\Application Data\Google Updater
2009-07-13 23:04:42 ----D---- C:\WINDOWS\system32\CatRoot2
2009-07-10 20:59:23 ----A---- C:\WINDOWS\NeroDigital.ini
2009-07-10 17:38:32 ----D---- C:\WINDOWS\system32
2009-07-10 17:12:33 ----D---- C:\Program Files\Fichiers communs
2009-07-10 14:31:35 ----HD---- C:\Program Files\InstallShield Installation Information
2009-07-10 09:28:40 ----D---- C:\Program Files\Ubisoft
2009-07-10 09:24:23 ----SHD---- C:\WINDOWS\Installer
2009-07-10 09:24:22 ----SHD---- C:\Config.Msi
2009-06-30 22:33:41 ----D---- C:\Documents and Settings\Pascal.ADMIN.000\Application Data\dvdcss
2009-06-27 17:29:39 ----D---- C:\Documents and Settings\Pascal.ADMIN.000\Application Data\LimeWire
2009-06-26 17:42:56 ----HD---- C:\WINDOWS\inf

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-02-05 26944]
R1 AsIO;AsIO; C:\WINDOWS\system32\drivers\AsIO.sys [2006-10-18 12664]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-02-05 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-02-05 51376]
R1 InCDPass;InCDPass; C:\WINDOWS\System32\DRIVERS\InCDPass.sys [2004-02-18 27440]
R1 incdrm;InCD EasyWrite Reader; C:\WINDOWS\system32\drivers\incdrm.sys [2003-12-30 28080]
R1 intelppm;Pilote de processeur Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-05 40320]
R1 kbdhid;Pilote HID de clavier; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-02-05 94032]
R3 Arp1394;Protocole client ARP 1394; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-05 60800]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-02-05 23152]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller; C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2007-03-15 38656]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2007-05-18 2164736]
R3 ATIAVAIW;ATI T200 Unified AVStream service; C:\WINDOWS\system32\DRIVERS\atinavt2.sys [2007-04-26 169088]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-03-19 23400]
R3 HdAudAddService;ATI Function Driver for High Definition Audio Service; C:\WINDOWS\system32\drivers\AtiHdAud.sys [2006-12-28 84992]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 hidusb;Pilote de classe HID Microsoft; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-03-26 4395008]
R3 L8042Kbd;Logitech SetPoint Keyboard Driver; C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys [2008-02-29 20240]
R3 mouhid;Pilote HID de souris; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-23 12288]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 NIC1394;Pilote réseau 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-05 61824]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2004-08-05 5888]
R3 usbccgp;Pilote parent générique USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-05 31616]
R3 usbehci;Pilote miniport de contrôleur d'hôte amélioré Microsoft USB 2.0; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;Pilote de concentrateur standard USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbprint;Classe d'imprimantes USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 25856]
R3 usbscan;Pilote de scanneur USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
R3 USBSTOR;Pilote de stockage de masse USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
R3 usbuhci;Pilote miniport de contrôleur hôte universel USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-04 20480]
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver; C:\WINDOWS\system32\drivers\WmBEnum.sys [2008-01-24 19336]
R3 WmXlCore;Logitech Translation Layer Driver; C:\WINDOWS\system32\drivers\WmXlCore.sys [2008-01-24 48904]
R4 InCDfs;InCD File System; C:\WINDOWS\system32\drivers\InCDfs.sys [2004-02-18 94416]
S2 ksi32sk;ksi32sk; \??\C:\WINDOWS\system32\drivers\ksi32sk.sys []
S3 a35g39xm;a35g39xm; C:\WINDOWS\system32\drivers\a35g39xm.sys []
S3 abl63q5e;abl63q5e; C:\WINDOWS\system32\drivers\abl63q5e.sys []
S3 CCDECODE;Décodeur sous-titre fermé; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-04 17024]
S3 DCamUSBSQTECH;Dual-Mode DSC(2770); C:\WINDOWS\System32\Drivers\SQcaptur.sys [2003-01-10 30921]
S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys []
S3 EntDrv51;EntDrv51; \??\C:\WINDOWS\system32\drivers\EntDrv51.sys []
S3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys [2008-02-29 35344]
S3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys [2007-09-21 36240]
S3 LUsbFilt;Logitech SetPoint KMDF USB Filter; C:\WINDOWS\System32\Drivers\LUsbFilt.Sys [2008-02-29 28944]
S3 MPE;Filtre BDA MPE; C:\WINDOWS\system32\DRIVERS\MPE.sys [2004-08-04 15360]
S3 MSTEE;Convertisseur en T/site-à-site de répartition Microsoft; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 NABTSFEC;Codec NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-04 85376]
S3 NdisIP;Connection TV/vidéo Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-04 10880]
S3 PCAMPR5;PCAMPR5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCAMPR5.SYS []
S3 PCANDIS5;PCANDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\system32\PCANDIS5.SYS []
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 PnkBstrK;PnkBstrK; \??\C:\WINDOWS\system32\drivers\PnkBstrK.sys []
S3 SLIP;Détrameur décalage BDA; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-04 11136]
S3 SQTECH905C;DaulCamera; C:\WINDOWS\System32\Drivers\Capt905c.sys [2004-08-04 29400]
S3 SQTECH9090;TOP Cam(PID_9090_00); C:\WINDOWS\System32\Drivers\Capt9090.sys [2007-06-13 48384]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-04 15360]
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2009-03-26 36864]
S3 usbaudio;Pilote USB audio (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-04 59264]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-11-02 492000]
S3 WmFilter;Logitech Gaming HID Filter Driver; C:\WINDOWS\system32\drivers\WmFilter.sys [2008-01-24 28168]
S3 WmVirHid;Logitech Virtual Hid Device Driver; C:\WINDOWS\system32\drivers\WmVirHid.sys [2008-01-24 14728]
S3 WSTCODEC;Codec Teletext standard; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-04 19328]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-03-26 132424]
R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-02-05 18752]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2007-05-18 479232]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-02-05 138680]
R2 Bonjour Service;Service Bonjour; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 FTRTSVC;France Telecom Routing Table Service; C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe [2007-09-25 65536]
R2 IISADMIN;Administration IIS; C:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-05 15872]
R2 InCDsrv;InCD Helper; C:\Program Files\Ahead\InCD\InCDsrv.exe [2004-02-18 876665]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-11-10 152984]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-05-01 75064]
R2 PnkBstrB;PnkBstrB; C:\WINDOWS\system32\PnkBstrB.exe [2009-05-09 189472]
R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP); C:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-05 15872]
R2 StarWindServiceAE;StarWind AE Service; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [2007-05-28 275968]
R2 W3SVC;Publication World Wide Web; C:\WINDOWS\system32\inetsrv\inetinfo.exe [2004-08-05 15872]
R2 WinSvc;Gestionnaire de mise à jour Winsudate; C:\Program Files\Winsudate\gibsvc.exe [2009-07-07 70384]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-02-05 254040]
R3 iPod Service;Service de l’iPod; C:\Program Files\iPod\bin\iPodService.exe [2009-04-02 656168]
R3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-11-11 620544]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2007-05-17 520192]
S2 gupdate1c9e6032e0728a2;Service Google Update (gupdate1c9e6032e0728a2); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-06-05 133104]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-24 183280]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-02-05 352920]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 LBTServ;Logitech Bluetooth Service; C:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe [2008-05-02 121360]
S3 ose;Office Source Engine; C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2004-08-05 14336]
S3 WMPNetworkSvc;Service Partage réseau du Lecteur Windows Media; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-05 14336]

-----------------EOF-----------------

---------------------------------------------------------------------
info.txt
-------------------------------------------------------------------------
info.txt logfile of random's system information tool 1.06 2009-07-15 18:27:30

======Uninstall list======

-->C:\PROGRA~1\Yahoo!\Common\UNYT_W~1.EXE
-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
ABBYY FineReader 6.0 Sprint-->MsiExec.exe /I{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->MsiExec.exe /X{ECA1A3B6-898F-4DCE-9F04-714CF3BA126B}
Adobe Reader 8.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81200000003}
Adobe Shockwave Player 11.5-->"C:\WINDOWS\system32\Adobe\Shockwave 11\uninstaller.exe"
Alone in the Dark - The New Nightmare-->C:\WINDOWS\IsUn040c.exe -f"f:\Infogrames\Alone in the Dark\Uninst.isu"
Apple Mobile Device Support-->MsiExec.exe /I{AFA20D47-69C3-4030-8DF8-D37466E70F13}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ArcSoft Funhouse 1.0-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5FC4811E-29F4-4035-9274-43A16816152D}\Setup.exe" -l0x40c
ArcSoft Panorama Maker 4-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D45E8C45-B601-4A80-AFD8-E16338744DE1}\Setup.exe" -l0x40c
ArcSoft PhotoImpression 4-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{68D5CEF9-0DA8-47FE-B0EB-4CBFB5AAF662}\setup.exe" -l0x40c
Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
ATI - Utilitaire de désinstallation du logiciel-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x0
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
ATI Parental Control & Encoder-->MsiExec.exe /I{36CDA33B-909B-4719-97D1-C4B99309BDC7}
avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
AviSynth 2.5-->"C:\Program Files\AviSynth 2.5\Uninstall.exe"
AVIVO Codecs-->MsiExec.exe /X{C941F1F1-25B3-4DF5-83E6-888C51A1AAB6}
AVS Update Manager 1.0-->"C:\Program Files\AVS4YOU\AVSUpdateManager\unins000.exe"
AVS Video Converter 6-->"C:\Program Files\AVS4YOU\AVSVideoConverter6\unins000.exe"
AVS Video to GO-->"C:\Program Files\AVS4YOU\AVSVideotoGO\unins000.exe"
AVS4YOU Software Navigator 1.3-->"C:\Program Files\AVS4YOU\AVSSoftwareNavigator\unins000.exe"
Battlefield 2(TM)-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}\setup.exe" -l0x40c -removeonly
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
Call of Duty(R) 4 - Modern Warfare(TM)-->C:\Program Files\InstallShield Installation Information\{E48469CC-635E-4FD5-A122-1497C286D217}\setup.exe -runfromtemp -l0x040c
Camera RAW Plug-In for EPSON Creativity Suite-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{42EDF895-158C-484E-A7F2-42B90759F281}\SETUP.EXE" -l0x40c UNINST
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
CDDRV_Installer-->MsiExec.exe /I{0C826C5B-B131-423A-A229-C71B3CACCD6A}
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Colin McRae Rally 3-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D26D1A53-D8A2-4004-BC98-0642B4EEAAB2}\setup.exe" -l0x40c
EPSON Attach To Email-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{20C45B32-5AB6-46A4-94EF-58950CAF05E5} /l1033 ADDREMOVEDLG
EPSON Easy Photo Print-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8A8F8391-4C2C-4BE1-A984-CD4A5A546467}\SETUP.EXE" -l0x40c UNINST
EPSON File Manager-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{46CBBDF8-55B5-40DB-B459-7B848394309C}\Setup.exe" -l0x40c UNINST
EPSON Logiciel imprimante-->C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\epupdate.exe /r
EPSON Scan Assistant-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}\Setup.exe" -l0x40c -u
EPSON Scan-->C:\Program Files\epson\escndv\setup\setup.exe /r
EPSON Stylus SX200 Series Printer Uninstall-->C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FINSEFE.EXE /R /APD /P:"EPSON Stylus SX200 Series"
EPSON Stylus SX200_SX400_TX200_TX400 Manuel-->C:\Program Files\EPSON\TPMANUAL\ES_SX_TX\FRA\USE_G\DOCUNINS.EXE
EPSON Web-To-Page-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}\SETUP.EXE" -l0x40c -anything
ESSBrwr-->MsiExec.exe /I{643EAE81-920C-4931-9F0B-4B343B225CA6}
ESSCDBK-->MsiExec.exe /I{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}
ESScore-->MsiExec.exe /I{9D8FEE90-0377-49A9-AEFB-525BDE549BA4}
ESSgui-->MsiExec.exe /I{91517631-A9F3-4B7C-B482-43E0068FD55A}
ESSini-->MsiExec.exe /I{8E92D746-CD9F-4B90-9668-42B74C14F765}
ESSPCD-->MsiExec.exe /I{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}
ESSSONIC-->MsiExec.exe /I{073F22CE-9A5B-4A40-A604-C7270AC6BF34}
ESSTOOLS-->MsiExec.exe /I{8A502E38-29C9-49FA-BCFA-D727CA062589}
essvatgt-->MsiExec.exe /I{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}
Google Chrome-->"C:\Program Files\Google\Chrome\Application\2.0.172.33\Installer\setup.exe" --uninstall --system-level
Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_9DE96A29E721D90A.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Guitar Pro 4.0.7-->C:\PROGRA~1\GUITAR~1\UNWISE.EXE C:\PROGRA~1\GUITAR~1\INSTALL.LOG
Guitar Pro 5.0-->"f:\Program Files\Guitar Pro 5\unins000.exe"
High Definition Audio Driver Package - KB888111-->C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Windows XP (KB915865)-->"C:\WINDOWS\$NtUninstallKB915865$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB926239)-->"C:\WINDOWS\$NtUninstallKB926239$\spuninst\spuninst.exe"
InCD EasyWrite Reader-->C:\WINDOWS\unmrw.exe /UNINSTALL
InCD-->C:\WINDOWS\NuNInst.exe /UNINSTALL
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{7370DF47-B4F9-4279-BFC3-3F09919F720D}
iTunes-->MsiExec.exe /I{5EFCBB42-36AB-4FF9-B90C-E78C7B9EE7B3}
Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216010FF}
Junk Mail filter update-->MsiExec.exe /I{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}
kgcbaby-->MsiExec.exe /I{E18B549C-5D15-45DA-8D8F-8FD2BD946344}
kgcbase-->MsiExec.exe /I{F22C222C-3CE2-4A4B-A83F-AF4681371ABE}
kgchday-->MsiExec.exe /I{11F3F858-4131-4FFA-A560-3FE282933B6E}
kgchlwn-->MsiExec.exe /I{03EDED24-8375-407D-A721-4643D9768BE1}
kgcinvt-->MsiExec.exe /I{9BD54685-1496-46A5-AB62-357CD140ED8B}
kgckids-->MsiExec.exe /I{693C08A7-9E76-43FF-B11E-9A58175474C4}
kgcmove-->MsiExec.exe /I{A1588373-1D86-4D44-86C9-78ABD190F9CC}
kgcvday-->MsiExec.exe /I{8A8664E1-84C8-4936-891C-BC1F07797549}
KhalInstallWrapper-->MsiExec.exe /I{3101CB58-3482-4D21-AF1A-7057FC935355}
K-Lite Mega Codec Pack 3.8.5-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
KSU-->MsiExec.exe /I{B997C2A0-4383-41BF-B76E-9B8B7ECFB267}
LEGO Racers-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\LEGO Media\Games\LEGO Racers\Uninst.isu"
LimeWire 5.1.2-->"C:\Program Files\LimeWire\uninstall.exe"
Logiciel Kodak EasyShare-->C:\Documents and Settings\All Users.WINDOWS\Application Data\Kodak\EasyShareSetup\$SETUP_140002_103bfba\Setup.exe /APR-REMOVE
Logitech Desktop Messenger-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}\SETUP.EXE" -l0x40c UNINSTALL
Logitech Gaming Software 5.02-->MsiExec.exe /X{64B20B36-AEE7-4DD4-897C-C5DA5C218F60}
Logitech SetPoint-->C:\Program Files\InstallShield Installation Information\{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}\setup.exe -runfromtemp -l0x040c -removeonly
Medal of Honor Débarquement allié(tm) En Formation-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7914BE1E-F186-4790-B8F4-9F63C52A41C1}\Setup.exe" -l0x40c
Medal of Honor Débarquement Allié(tm) l'Offensive-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{823A68CC-3049-4A6B-8F63-7DC85E4BB1C9}\Setup.exe" -l0x40c
Medal of Honor débarquement allié-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{0DEA94ED-915A-4834-A87E-388D012C8E02}\Setup.exe" -l0x40c
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
MP Manager-->MsiExec.exe /X{49E597BA-63D3-4936-9E02-AEDB5D1FE002}
MP Manager-->MsiExec.exe /X{7DE4B31F-651E-4773-8DD4-399E7E58477E}
MSVC80_x86-->MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27}
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
My DSC-->C:\Program Files\InstallShield Installation Information\{225af9a1-b556-88d5-94aa-0010b5426419}\setup.exe
MyDSC2-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{83D96ED0-98AA-4515-8DDC-816F3EFDD104}\Setup.exe" -l0x9
Nero BurnRights-->C:\WINDOWS\UNNeroBurnRights.exe /UNINSTALL
Nero OEM-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
NeroVision Express 2 SE--&

24 réponses

Résumé de la discussion

Infection informatique critique sur un ordinateur Windows XP Professionnel SP2, avec des alertes Kelvir, Cutwail, BHO-VX Fakealert-AT et Hybris rootkit, et une demande d’aide pour les éliminer. Les rapports RSIT et HijackThis détaillent des processus, modules et éléments de démarrage suspects, notamment de multiples svchost.exe et des Browser Helper Objects. La liste couvre des BHOs, des services et des tâches planifiées, avec des URLs et des pages de démarrage modifiées signalant une compromission du navigateur. L'objectif est d'identifier des approches de nettoyage adaptées à Windows XP en s'appuyant sur ces logs et sur des conseils techniques pour une suppression manuelle ou via des outils antivirus.

Bobot (l’IA à votre service)
  1. Nic00
    Ok, maintenant fais un scan en ligne avec bitdefender:
    http://www.bitdefender.fr/scan_fr/scan8/ie.html
    1. lylas31
      Salut Nic00,

      Je n'arrive toujours pas a lancer en ligne 'bitdefender', j'ai toujours le meme message d'erreur , y a til une autre solution ?
      Merci d'avance !
  2. lylas31
    ok c'est fait, j'ai lancé EasyCleaner et supprimer les éléments obsolètes du registre
    1. Nic00
      ▶Télécharge Easy Cleaner :
      http://www.commentcamarche.net/telecharger/telecharger 34055442 easycleaner

      ▶Installe-le puis lance le.
      ▶Clique sur le bouton Registre du menu principal d'EasyCleaner
      ▶Pour commencer la recherche de clés/valeurs obsolètes dans le registre, clique sur le bouton Trouver.
      ▶Une fois la recherche terminée, la liste des éléments obsolètes du registre apparaît : afin de tout nettoyer, clique sur Supprime tout. Tu pourras également sélectionner les entrées du registre à supprimer puis cliquer sur le bouton Supprimer.
      ▶Une boîte de dialogue s'ouvre alors pour te demander confirmation de la suppression, clique sur Yes
      ▶Tu peux effectuer d’autres fonctions si tu le souhaite :
      Ajout/suppression, Doublons, Inutile(s), Raccourcis, Espace-Disque disponible, Démarrage, Vider des fichiers, Vider "cookies", Vider l'historique, Documents, Rétablir (au cas ou tu aurais supprimer des choses que tu ne souhaitais pas)….
      1. lylas31
        le rapport suite suppression :

        -----------\\ ToolBar S&D 1.2.8 XP/Vista

        Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
        X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz )
        BIOS : BIOS Date: 07/03/07 10:01:10 Ver: 08.00.12
        USER : Pascal ( Administrator )
        BOOT : Normal boot
        Antivirus : avast! antivirus 4.8.1335 [VPS 090722-0] 4.8.1335 (Activated)
        C:\ (Local Disk) - NTFS - Total:127 Go (Free:53 Go)
        D:\ (CD or DVD)
        E:\ (Local Disk) - NTFS - Total:14 Go (Free:14 Go)
        F:\ (Local Disk) - NTFS - Total:155 Go (Free:8 Go)
        G:\ (CD or DVD)
        H:\ (CD or DVD)

        "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
        Option : [2] ( 22/07/2009|21:38 )

        -----------\\ SUPPRESSION

        Supprime! - C:\Program Files\DAEMON Tools Toolbar

        -----------\\ Recherche de Fichiers / Dossiers ...

        -----------\\ [..\Internet Explorer\Main]

        [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
        "Start Page"="https://www.google.fr/?gws_rd=ssl"
        "Local Page"="C:\\windows\\system32\\blank.htm"
        "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
        "Default_search_url"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

        [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
        "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
        "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
        "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
        "Local Page"="C:\\windows\\system32\\blank.htm"
        "Start Page"="https://www.msn.com/fr-fr/"

        --------------------\\ Recherche d'autres infections

        Aucune autre infection trouvée !

        1 - "C:\ToolBar SD\TB_1.txt" - 22/07/2009|20:33 - Option : [1]
        2 - "C:\ToolBar SD\TB_2.txt" - 22/07/2009|21:39 - Option : [2]

        -----------\\ Fin du rapport a 21:39:39,42
        2. Nic00
          ▶Relances ToolBarSD
          ▶Choisis l'option2 ( suppression)
          ▶Ne touche à rien pendant la suppression.
          ▶A la fin, un rapport est généré, postes le!

          / !\ Si tu es sous Vista, veille à ce que le compte des utilisateurs soit désactivé.
          Panneau de configuration>comptes utilisateurs>activer/désactiver le contrôle des comptes utilisateurs>décoche la case puis fais OK

          Tuto: https://www.zebulon.fr/astuces/pratique/220-desactiver-l-uac-dans-vista.html
          1. lylas31
            voila les 2 rapports :

            -----------\\ ToolBar S&D 1.2.8 XP/Vista

            Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
            X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU E4500 @ 2.20GHz )
            BIOS : BIOS Date: 07/03/07 10:01:10 Ver: 08.00.12
            USER : Pascal ( Administrator )
            BOOT : Normal boot
            Antivirus : avast! antivirus 4.8.1335 [VPS 090722-0] 4.8.1335 (Activated)
            C:\ (Local Disk) - NTFS - Total:127 Go (Free:53 Go)
            D:\ (CD or DVD)
            E:\ (Local Disk) - NTFS - Total:14 Go (Free:14 Go)
            F:\ (Local Disk) - NTFS - Total:155 Go (Free:8 Go)
            G:\ (CD or DVD)
            H:\ (CD or DVD)

            "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
            Option : [1] ( 22/07/2009|20:33 )

            -----------\\ Recherche de Fichiers / Dossiers ...

            C:\Program Files\DAEMON Tools Toolbar

            -----------\\ [..\Internet Explorer\Main]

            [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
            "Start Page"="https://www.google.fr/?gws_rd=ssl"
            "Local Page"="C:\\windows\\system32\\blank.htm"
            "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
            "Default_search_url"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

            [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
            "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
            "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
            "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
            "Local Page"="C:\\windows\\system32\\blank.htm"
            "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"

            --------------------\\ Recherche d'autres infections

            Aucune autre infection trouvée !

            1 - "C:\ToolBar SD\TB_1.txt" - 22/07/2009|20:33 - Option : [1]

            -----------\\ Fin du rapport a 20:33:58,35

            -------------------------------------------------------------------------------------------------------------------------
            Rapport OTM :
            ---------------------------------------------------------------------------------------------------------------------------
            All processes killed
            ========== PROCESSES ==========
            No active process named explorer.exe was found!
            ========== FILES ==========
            C:\Program Files\Winsudate moved successfully.
            C:\WINDOWS\system32\tmp.txt moved successfully.
            ========== COMMANDS ==========

            [EMPTYTEMP]

            User: Administrateur
            ->Temp folder emptied: 0 bytes
            ->Temporary Internet Files folder emptied: 67 bytes

            User: All Users

            User: All Users.WINDOWS

            User: Ava
            ->Temp folder emptied: 0 bytes
            ->Temporary Internet Files folder emptied: 78991 bytes

            User: Ava.ADMIN
            ->Temp folder emptied: 0 bytes
            ->Temporary Internet Files folder emptied: 78991 bytes

            User: Default User
            ->Temp folder emptied: 0 bytes
            ->Temporary Internet Files folder emptied: 67 bytes

            User: Default User.WINDOWS
            ->Temp folder emptied: 0 bytes
            ->Temporary Internet Files folder emptied: 67 bytes

            User: Jeux
            ->Temp folder emptied: 0 bytes
            ->Temporary Internet Files folder emptied: 67 bytes

            User: LocalService
            ->Temp folder emptied: 0 bytes
            ->Temporary Internet Files folder emptied: 33170 bytes

            User: LocalService.AUTORITE NT
            ->Temp folder emptied: 0 bytes
            ->Temporary Internet Files folder emptied: 67 bytes

            User: LocalService.AUTORITE NT.000
            ->Temp folder emptied: 66016 bytes
            File delete failed. C:\Documents and Settings\LocalService.AUTORITE NT.000\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
            ->Temporary Internet Files folder emptied: 262278 bytes

            User: Lydie
            ->Temp folder emptied: 0 bytes
            ->Temporary Internet Files folder emptied: 78991 bytes

            User: Lydie.ADMIN
            ->Temp folder emptied: 0 bytes
            ->Temporary Internet Files folder emptied: 78991 bytes

            User: NetworkService
            ->Temp folder emptied: 0 bytes
            ->Temporary Internet Files folder emptied: 402 bytes

            User: NetworkService.AUTORITE NT
            ->Temp folder emptied: 0 bytes
            ->Temporary Internet Files folder emptied: 67 bytes

            User: NetworkService.AUTORITE NT.000
            ->Temp folder emptied: 0 bytes
            File delete failed. C:\Documents and Settings\NetworkService.AUTORITE NT.000\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
            ->Temporary Internet Files folder emptied: 32902 bytes

            User: Pascal
            ->Temp folder emptied: 0 bytes
            ->Temporary Internet Files folder emptied: 67 bytes

            User: Pascal.ADMIN.000
            ->Temp folder emptied: 77095752 bytes
            ->Temporary Internet Files folder emptied: 98019853 bytes
            ->Java cache emptied: 130684 bytes
            ->Google Chrome cache emptied: 691100 bytes

            User: PASCAL~1~000

            User: Valentin
            ->Temp folder emptied: 0 bytes
            ->Temporary Internet Files folder emptied: 67 bytes

            User: Valentin.ADMIN

            User: Valentin.ADMIN.000
            ->Temp folder emptied: 0 bytes
            ->Temporary Internet Files folder emptied: 2692427 bytes

            User: Ylan
            ->Temp folder emptied: 0 bytes
            ->Temporary Internet Files folder emptied: 67 bytes

            User: Ylan.ADMIN
            ->Temp folder emptied: 0 bytes
            ->Temporary Internet Files folder emptied: 67 bytes

            %systemdrive% .tmp files removed: 0 bytes
            C:\WINDOWS\230C4A452586416184EF5C0D75D5B270.TMP folder deleted successfully.
            %systemroot% .tmp files removed: 2491769 bytes
            %systemroot%\System32 .tmp files removed: 2891264 bytes
            File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot.
            File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_6cc.dat scheduled to be deleted on reboot.
            Windows Temp folder emptied: 49152 bytes
            RecycleBin emptied: 53835 bytes

            Total Files Cleaned = 176,26 mb

            OTM by OldTimer - Version 3.0.0.5 log created on 07222009_203611
            1. Nic00
              ▶Télécharge Toolbar S&D:
              https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

              ▶ Lances l'installation en exécutant le fichier téléchargé...

              ▶ Double-clique sur le raccourci de Toolbar, qui se trouve sur ton bureau, pour lancer l'application.

              ▶sélectionnes la langue, puis valides par la touche '' Entrée '' de ton clavier...

              ▶ Au menu, choisis l'option1 (recherche) et patientes jusqu'à la fin de la recherche.

              ▶ Un rapport sera généré à la fin. Poste-le stp.

              ▶Télécharge OTMoveIt3 (de Old_Timer) sur ton Bureau :
              http://www.geekstogo.com/forum/files/file/402-otm-oldtimers-move-it/
              ▶Double-clique sur OTMoveIt.exe pour le lancer.
              ▶Assure toi que la case "Unregister Dll's and Ocx's" soit bien cochée
              ▶Copie / colle les lignes suivantes dans la fenêtre de gauche de OTMoveIt nommé "Paste List of Files/Folders to be moved". 

              :Processes
explorer.exe

:Files
C:\Program Files\Winsudate
C:\WINDOWS\system32\tmp.txt


:Commands 
[emptytemp] 
[Reboot]
[start explorer]


              ▶Clique sur MoveIt! pour lancer la suppression.
              ▶Si OTMoveIt propose de redémarrer ton PC, accepte.
              ▶Lorsque un résultat apparaît dans le cadre Results, clique sur Exit.

              ▶Dans ta prochaine réponse, envoie le rapport de OTMoveIt situé ici: C:\_OTMoveIt\MovedFiles

              1. Nic00
                Pourquoi tu mets kaspersky ???
                Tu fais quoi là ?
                Ça viens de me faire tilt t'es en train de faire ça :http://www.commentcamarche.net/forum/affich 13372977 help ordinateur infecte par virus?#3
                nan ?

                Si c'est le cas ne le fais pas (en plus kaspersky est en période d'essai, à moins que tu l'ais acheté)
                1. lylas31
                  c alzeimer qui me guette ...j'ai confondu RSIT avec Kaspersky ...!
                  dans tous les cas, merci pour ta patience !

                  Voici les rapports RSIT :

                  info.txt logfile of random's system information tool 1.06 2009-07-22 19:47:41

                  ======Uninstall list======

                  -->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
                  -->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
                  -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
                  ABBYY FineReader 6.0 Sprint-->MsiExec.exe /I{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}
                  Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
                  Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
                  Adobe Flash Player 10 Plugin-->MsiExec.exe /X{ECA1A3B6-898F-4DCE-9F04-714CF3BA126B}
                  Adobe Reader 8.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81200000003}
                  Adobe Shockwave Player 11.5-->"C:\WINDOWS\system32\Adobe\Shockwave 11\uninstaller.exe"
                  Ad-remover-->C:\Program Files\Ad-remover\Uninstall ADR.exe
                  Alone in the Dark - The New Nightmare-->C:\WINDOWS\IsUn040c.exe -f"f:\Infogrames\Alone in the Dark\Uninst.isu"
                  Apple Mobile Device Support-->MsiExec.exe /I{AFA20D47-69C3-4030-8DF8-D37466E70F13}
                  Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
                  ArcSoft Funhouse 1.0-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5FC4811E-29F4-4035-9274-43A16816152D}\Setup.exe" -l0x40c
                  ArcSoft Panorama Maker 4-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D45E8C45-B601-4A80-AFD8-E16338744DE1}\Setup.exe" -l0x40c
                  ArcSoft PhotoImpression 4-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{68D5CEF9-0DA8-47FE-B0EB-4CBFB5AAF662}\setup.exe" -l0x40c
                  Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
                  ATI - Utilitaire de désinstallation du logiciel-->C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
                  ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x0
                  ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
                  ATI Parental Control & Encoder-->MsiExec.exe /I{36CDA33B-909B-4719-97D1-C4B99309BDC7}
                  avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
                  AviSynth 2.5-->"C:\Program Files\AviSynth 2.5\Uninstall.exe"
                  AVIVO Codecs-->MsiExec.exe /X{C941F1F1-25B3-4DF5-83E6-888C51A1AAB6}
                  AVS Update Manager 1.0-->"C:\Program Files\AVS4YOU\AVSUpdateManager\unins000.exe"
                  AVS Video Converter 6-->"C:\Program Files\AVS4YOU\AVSVideoConverter6\unins000.exe"
                  AVS Video to GO-->"C:\Program Files\AVS4YOU\AVSVideotoGO\unins000.exe"
                  AVS4YOU Software Navigator 1.3-->"C:\Program Files\AVS4YOU\AVSSoftwareNavigator\unins000.exe"
                  Battlefield 2(TM)-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}\setup.exe" -l0x40c -removeonly
                  Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
                  Call of Duty(R) 4 - Modern Warfare(TM)-->C:\Program Files\InstallShield Installation Information\{E48469CC-635E-4FD5-A122-1497C286D217}\setup.exe -runfromtemp -l0x040c
                  Camera RAW Plug-In for EPSON Creativity Suite-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{42EDF895-158C-484E-A7F2-42B90759F281}\SETUP.EXE" -l0x40c UNINST
                  CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
                  CDDRV_Installer-->MsiExec.exe /I{0C826C5B-B131-423A-A229-C71B3CACCD6A}
                  Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
                  Colin McRae Rally 3-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D26D1A53-D8A2-4004-BC98-0642B4EEAAB2}\setup.exe" -l0x40c
                  EPSON Attach To Email-->C:\Program Files\Fichiers communs\InstallShield\Driver\8\Intel 32\IDriver.exe /M{20C45B32-5AB6-46A4-94EF-58950CAF05E5} /l1033 ADDREMOVEDLG
                  EPSON Easy Photo Print-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8A8F8391-4C2C-4BE1-A984-CD4A5A546467}\SETUP.EXE" -l0x40c UNINST
                  EPSON File Manager-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{46CBBDF8-55B5-40DB-B459-7B848394309C}\Setup.exe" -l0x40c UNINST
                  EPSON Logiciel imprimante-->C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\epupdate.exe /r
                  EPSON Scan Assistant-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{2A88F1BF-7041-4E42-84B1-6B4ACB83AC64}\Setup.exe" -l0x40c -u
                  EPSON Scan-->C:\Program Files\epson\escndv\setup\setup.exe /r
                  EPSON Stylus SX200 Series Printer Uninstall-->C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FINSEFE.EXE /R /APD /P:"EPSON Stylus SX200 Series"
                  EPSON Stylus SX200_SX400_TX200_TX400 Manuel-->C:\Program Files\EPSON\TPMANUAL\ES_SX_TX\FRA\USE_G\DOCUNINS.EXE
                  EPSON Web-To-Page-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}\SETUP.EXE" -l0x40c -anything
                  ESSBrwr-->MsiExec.exe /I{643EAE81-920C-4931-9F0B-4B343B225CA6}
                  ESSCDBK-->MsiExec.exe /I{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}
                  ESScore-->MsiExec.exe /I{9D8FEE90-0377-49A9-AEFB-525BDE549BA4}
                  ESSgui-->MsiExec.exe /I{91517631-A9F3-4B7C-B482-43E0068FD55A}
                  ESSini-->MsiExec.exe /I{8E92D746-CD9F-4B90-9668-42B74C14F765}
                  ESSPCD-->MsiExec.exe /I{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}
                  ESSSONIC-->MsiExec.exe /I{073F22CE-9A5B-4A40-A604-C7270AC6BF34}
                  ESSTOOLS-->MsiExec.exe /I{8A502E38-29C9-49FA-BCFA-D727CA062589}
                  essvatgt-->MsiExec.exe /I{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}
                  Google Chrome-->"C:\Program Files\Google\Chrome\Application\2.0.172.37\Installer\setup.exe" --uninstall --system-level
                  Google Earth-->MsiExec.exe /I{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}
                  Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_9DE96A29E721D90A.exe" /uninstall
                  Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
                  Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
                  Guitar Pro 4.0.7-->C:\PROGRA~1\GUITAR~1\UNWISE.EXE C:\PROGRA~1\GUITAR~1\INSTALL.LOG
                  Guitar Pro 5.0-->"f:\Program Files\Guitar Pro 5\unins000.exe"
                  High Definition Audio Driver Package - KB888111-->C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe
                  HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
                  Hotfix for Windows XP (KB915865)-->"C:\WINDOWS\$NtUninstallKB915865$\spuninst\spuninst.exe"
                  Hotfix for Windows XP (KB926239)-->"C:\WINDOWS\$NtUninstallKB926239$\spuninst\spuninst.exe"
                  InCD EasyWrite Reader-->C:\WINDOWS\unmrw.exe /UNINSTALL
                  InCD-->C:\WINDOWS\NuNInst.exe /UNINSTALL
                  Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
                  Installation Windows Live-->MsiExec.exe /I{7370DF47-B4F9-4279-BFC3-3F09919F720D}
                  iTunes-->MsiExec.exe /I{5EFCBB42-36AB-4FF9-B90C-E78C7B9EE7B3}
                  Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216010FF}
                  Junk Mail filter update-->MsiExec.exe /I{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}
                  kgcbaby-->MsiExec.exe /I{E18B549C-5D15-45DA-8D8F-8FD2BD946344}
                  kgcbase-->MsiExec.exe /I{F22C222C-3CE2-4A4B-A83F-AF4681371ABE}
                  kgchday-->MsiExec.exe /I{11F3F858-4131-4FFA-A560-3FE282933B6E}
                  kgchlwn-->MsiExec.exe /I{03EDED24-8375-407D-A721-4643D9768BE1}
                  kgcinvt-->MsiExec.exe /I{9BD54685-1496-46A5-AB62-357CD140ED8B}
                  kgckids-->MsiExec.exe /I{693C08A7-9E76-43FF-B11E-9A58175474C4}
                  kgcmove-->MsiExec.exe /I{A1588373-1D86-4D44-86C9-78ABD190F9CC}
                  kgcvday-->MsiExec.exe /I{8A8664E1-84C8-4936-891C-BC1F07797549}
                  KhalInstallWrapper-->MsiExec.exe /I{3101CB58-3482-4D21-AF1A-7057FC935355}
                  K-Lite Mega Codec Pack 3.8.5-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
                  KSU-->MsiExec.exe /I{B997C2A0-4383-41BF-B76E-9B8B7ECFB267}
                  LEGO Racers-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\LEGO Media\Games\LEGO Racers\Uninst.isu"
                  LimeWire 5.1.2-->"C:\Program Files\LimeWire\uninstall.exe"
                  Logiciel Kodak EasyShare-->C:\Documents and Settings\All Users.WINDOWS\Application Data\Kodak\EasyShareSetup\$SETUP_140002_103bfba\Setup.exe /APR-REMOVE
                  Logitech Desktop Messenger-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}\SETUP.EXE" -l0x40c UNINSTALL
                  Logitech Gaming Software 5.02-->MsiExec.exe /X{64B20B36-AEE7-4DD4-897C-C5DA5C218F60}
                  Logitech SetPoint-->C:\Program Files\InstallShield Installation Information\{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}\setup.exe -runfromtemp -l0x040c -removeonly
                  Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
                  Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
                  Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
                  Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
                  Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
                  Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
                  Microsoft Office Professional Edition 2003-->MsiExec.exe /I{9011040C-6000-11D3-8CFE-0150048383C9}
                  Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
                  MP Manager-->MsiExec.exe /X{49E597BA-63D3-4936-9E02-AEDB5D1FE002}
                  MP Manager-->MsiExec.exe /X{7DE4B31F-651E-4773-8DD4-399E7E58477E}
                  MSVC80_x86-->MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27}
                  MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
                  My DSC-->C:\Program Files\InstallShield Installation Information\{225af9a1-b556-88d5-94aa-0010b5426419}\setup.exe
                  MyDSC2-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{83D96ED0-98AA-4515-8DDC-816F3EFDD104}\Setup.exe" -l0x9
                  Nero BurnRights-->C:\WINDOWS\UNNeroBurnRights.exe /UNINSTALL
                  Nero OEM-->C:\Program Files\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
                  NeroVision Express 2 SE-->C:\WINDOWS\UNNeroVision.exe /UNINSTALL
                  netbrdg-->MsiExec.exe /I{4537EA4B-F603-4181-89FB-2953FC695AB1}
                  Nikon Message Center-->MsiExec.exe /X{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}
                  Nikon Transfer-->MsiExec.exe /X{E9757890-7EC5-46C8-99AB-B00F07B6525C}
                  Nokia Connectivity Cable Driver-->MsiExec.exe /X{15AC0C5D-A6FB-4CE2-8CD0-28179EEB5625}
                  Nokia PC Suite-->C:\Documents and Settings\All Users.WINDOWS\Application Data\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Nokia_PC_Suite_7_1_18_0_fre.exe
                  Nokia PC Suite-->MsiExec.exe /I{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}
                  Notifier-->MsiExec.exe /I{0008546E-DF6E-4CC1-AFD0-2CB8E16C95A2}
                  OfotoXMI-->MsiExec.exe /I{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}
                  Outil de mise à jour Google-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
                  Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
                  Package de pilotes Windows - Nokia Modem (05/22/2008 3.8)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokia_blue_6F90B0F4A73A2F780A1010B5D6CB5DDFB098181E\nokia_bluetooth.inf
                  Package de pilotes Windows - Nokia Modem (05/22/2008 7.00.0.1)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokbtmdm_E68D50F7E25BFE399D47C864C3B52557346242A9\nokbtmdm.inf
                  Package de pilotes Windows - Nokia Modem (10/27/2008 3.9)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokia_blue_79486EC6AA0D1732FB17E5167077C07ECAE1B870\nokia_bluetooth.inf
                  Package de pilotes Windows - Nokia Modem (10/27/2008 7.01.0.1)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokbtmdm_247189AEBF39EB69A7C75429610DFED2F2EDC1B6\nokbtmdm.inf
                  Package de pilotes Windows - Nokia pccsmcfd (08/22/2008 7.0.0.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccsmcfd_A3B3916E5D8138F59EE218321B27B044D3B18294\pccsmcfd.inf
                  PC Connectivity Solution-->MsiExec.exe /I{D848D140-41C3-4A53-86D8-E866A100B4CD}
                  PhoTags Express 3-->C:\PROGRA~1\PHOTAG~1\Setup.exe /remove /q0
                  PowerDVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -uninstall
                  Prince of Persia T2T-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{DFFE2B1F-07E0-45A9-8801-CD8514CAA876}\setup.exe" -l0x40c -removeonly
                  Prince of Persia-->"C:\Program Files\InstallShield Installation Information\{7C11154F-3539-4CB5-979D-EF7913473E53}\setup.exe" -runfromtemp -l0x040c -removeonly
                  QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
                  RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
                  Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
                  SFR-->MsiExec.exe /I{DB02F716-6275-42E9-B8D2-83BA2BF5100B}
                  SHASTA-->MsiExec.exe /I{605A4E39-613C-4A12-B56F-DEFBE6757237}
                  SKIN0001-->MsiExec.exe /I{FDF9943A-3D5C-46B3-9679-586BD237DDEE}
                  SKINXSDK-->MsiExec.exe /I{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}
                  staticcr-->MsiExec.exe /I{8943CE61-53BD-475E-90E1-A580869E98A2}
                  tooltips-->MsiExec.exe /I{E79987F0-0E34-42CC-B8FF-6C860AEEB26A}
                  TOP Cam-->C:\Program Files\InstallShield Installation Information\{B571E4C7-EF38-4672-A862-D825519DED97}\setup.exe -runfromtemp -l0x040c -removeonly
                  VPRINTOL-->MsiExec.exe /I{999D43F4-9709-4887-9B1A-83EBB15A8370}
                  Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
                  Windows Internet Explorer 7-->"C:\WINDOWS\ie7\spuninst\spuninst.exe"
                  Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
                  Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
                  Windows Live Mail-->MsiExec.exe /I{63DC2DA0-2A6C-4C38-9249-B75395458657}
                  Windows Live Messenger-->MsiExec.exe /X{059C042E-796A-4ACC-A81A-ECC2010BB78C}
                  Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
                  Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
                  Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
                  Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
                  WIRELESS-->MsiExec.exe /I{F9593CFB-D836-49BC-BFF1-0E669A411D9F}

                  ======Security center information======

                  AV: avast! antivirus 4.8.1335 [VPS 090722-0]

                  ======System event log======

                  Computer Name: ADMIN
                  Event Code: 7035
                  Message: Un contrôle Démarrer a correctement été envoyé au service Gestionnaire de connexions d'accès distant.

                  Record Number: 7415
                  Source Name: Service Control Manager
                  Time Written: 20090625225026.000000+120
                  Event Type: Informations
                  User: AUTORITE NT\SYSTEM

                  Computer Name: ADMIN
                  Event Code: 7036
                  Message: Le service Téléphonie est entré dans l'état : en cours d'exécution.

                  Record Number: 7414
                  Source Name: Service Control Manager
                  Time Written: 20090625225026.000000+120
                  Event Type: Informations
                  User:

                  Computer Name: ADMIN
                  Event Code: 7035
                  Message: Un contrôle Démarrer a correctement été envoyé au service avast! Web Scanner.

                  Record Number: 7413
                  Source Name: Service Control Manager
                  Time Written: 20090625225026.000000+120
                  Event Type: Informations
                  User: AUTORITE NT\SYSTEM

                  Computer Name: ADMIN
                  Event Code: 7035
                  Message: Un contrôle Démarrer a correctement été envoyé au service avast! Mail Scanner.

                  Record Number: 7412
                  Source Name: Service Control Manager
                  Time Written: 20090625225026.000000+120
                  Event Type: Informations
                  User: AUTORITE NT\SYSTEM

                  Computer Name: ADMIN
                  Event Code: 6005
                  Message: Le service d'Enregistrement d'événement a démarré.

                  Record Number: 7411
                  Source Name: EventLog
                  Time Written: 20090625225009.000000+120
                  Event Type: Informations
                  User:

                  =====Application event log=====

                  Computer Name: ADMIN
                  Event Code: 105
                  Message: The service was started.

                  Record Number: 3311
                  Source Name: ATI Smart
                  Time Written: 20090122210615.000000+060
                  Event Type: Informations
                  User:

                  Computer Name: ADMIN
                  Event Code: 1002
                  Message: Application bloquée iexplore.exe, version 7.0.6000.16608, module bloqué hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

                  Record Number: 3310
                  Source Name: Application Hang
                  Time Written: 20090122210224.000000+060
                  Event Type: erreur
                  User:

                  Computer Name: ADMIN
                  Event Code: 1002
                  Message: Application bloquée iexplore.exe, version 7.0.6000.16608, module bloqué hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

                  Record Number: 3309
                  Source Name: Application Hang
                  Time Written: 20090122210213.000000+060
                  Event Type: erreur
                  User:

                  Computer Name: ADMIN
                  Event Code: 1002
                  Message: Application bloquée iexplore.exe, version 7.0.6000.16608, module bloqué hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

                  Record Number: 3308
                  Source Name: Application Hang
                  Time Written: 20090122210205.000000+060
                  Event Type: erreur
                  User:

                  Computer Name: ADMIN
                  Event Code: 1002
                  Message: Application bloquée iexplore.exe, version 7.0.6000.16608, module bloqué hungapp, version 0.0.0.0, adresse de blocage 0x00000000.

                  Record Number: 3307
                  Source Name: Application Hang
                  Time Written: 20090122210203.000000+060
                  Event Type: erreur
                  User:

                  ======Environment variables======

                  "ComSpec"=%SystemRoot%\system32\cmd.exe
                  "Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\PC Connectivity Solution;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static;C:\Program Files\QuickTime\QTSystem
                  "windir"=%SystemRoot%
                  "FP_NO_HOST_CHECK"=NO
                  "OS"=Windows_NT
                  "PROCESSOR_ARCHITECTURE"=x86
                  "PROCESSOR_LEVEL"=6
                  "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
                  "PROCESSOR_REVISION"=0f0d
                  "NUMBER_OF_PROCESSORS"=2
                  "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
                  "TEMP"=%SystemRoot%\TEMP
                  "TMP"=%SystemRoot%\TEMP
                  "CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
                  "QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip

                  -----------------EOF-----------------

                  Logfile of random's system information tool 1.06 (written by random/random)
                  Run by Pascal at 2009-07-22 19:47:39
                  Microsoft Windows XP Professionnel Service Pack 2
                  System drive C: has 54 GB (42%) free of 131 GB
                  Total RAM: 2047 MB (65% free)

                  Logfile of Trend Micro HijackThis v2.0.2
                  Scan saved at 19:47:40, on 22/07/2009
                  Platform: Windows XP SP2 (WinNT 5.01.2600)
                  MSIE: Internet Explorer v7.00 (7.00.6000.16608)
                  Boot mode: Normal

                  Running processes:
                  C:\WINDOWS\System32\smss.exe
                  C:\WINDOWS\system32\winlogon.exe
                  C:\WINDOWS\system32\services.exe
                  C:\WINDOWS\system32\lsass.exe
                  C:\WINDOWS\system32\Ati2evxx.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\Ahead\InCD\InCDsrv.exe
                  C:\WINDOWS\system32\Ati2evxx.exe
                  C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                  C:\Program Files\Alwil Software\Avast4\ashServ.exe
                  C:\WINDOWS\system32\spoolsv.exe
                  C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                  C:\Program Files\Bonjour\mDNSResponder.exe
                  C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
                  C:\WINDOWS\system32\inetsrv\inetinfo.exe
                  C:\Program Files\Java\jre6\bin\jqs.exe
                  C:\WINDOWS\system32\PnkBstrA.exe
                  C:\WINDOWS\system32\PnkBstrB.exe
                  C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
                  C:\WINDOWS\system32\svchost.exe
                  C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                  C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                  C:\WINDOWS\Explorer.EXE
                  C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
                  C:\Program Files\Ahead\InCD\InCD.exe
                  C:\Program Files\Java\jre6\bin\jusched.exe
                  C:\Program Files\QuickTime\QTTask.exe
                  C:\Program Files\iTunes\iTunesHelper.exe
                  C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                  C:\WINDOWS\system32\ctfmon.exe
                  C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
                  C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
                  C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
                  C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                  C:\Program Files\Logitech\SetPoint\SetPoint.exe
                  C:\Program Files\Fichiers communs\Nikon\Monitor\NkMonitor.exe
                  C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
                  C:\WINDOWS\System32\svchost.exe
                  C:\Program Files\iPod\bin\iPodService.exe
                  C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
                  C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
                  C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
                  C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
                  C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
                  F:\DRIVERS\RSIT.exe
                  C:\Program Files\trend micro\Pascal.exe

                  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
                  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                  O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
                  O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
                  O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
                  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
                  O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
                  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                  O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
                  O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
                  O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
                  O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
                  O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
                  O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
                  O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
                  O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
                  O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                  O4 - HKLM\..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
                  O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                  O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
                  O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
                  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
                  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
                  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                  O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                  O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
                  O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
                  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                  O4 - Startup: Nikon Monitor.lnk = ?
                  O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
                  O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
                  O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
                  O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
                  O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                  O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
                  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                  O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
                  O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
                  O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                  O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
                  O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
                  O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                  O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                  O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                  O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
                  O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
                  O23 - Service: Service Google Update (gupdate1c9e6032e0728a2) (gupdate1c9e6032e0728a2) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
                  O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
                  O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
                  O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                  O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
                  O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe
                  O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
                  O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
                  O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
                  O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
              2. lylas31
                eh bien parce que quand tu lances Kaspersky , il te demande de désactiver l'anti virus qui serait présent sur la machine , en ce qui me concerne j'ai avast deja installé et qui tourne en permanence . est ce queje le désactive pour permettre l'analyse avec Kaspersky ?
                2. Nic00
                  Dac ;-)

                  Prends ton temps...
                  1. lylas31
                    dis moi , faut il vraiment désactiver l'anti virus installé sur l'ordi avant de lancer Kaspersky ? si oui, pendant qu il fait son analyse (qui dure des heures d'ailleurs) , est ce que la machine reste protégée ?
                3. Nic00
                  Up! pour toi lylas31
                  1. lylas31
                    Hello ,

                    RSIT à 2h du matin, je n'ai pas percuté !
                    Sinon, l'ordi a planté 2 fois pendant l'execution de Kaspersky . Je recommencerai demain , je posterai les rapports demain soir (en espérant que tout se passe bien -> vive l'informatique !!)
                    @+
                6. Nic00
                  Bien.

                  Colle un nouveau rapport avec RSIT stp
                  1. lylas31
                    désolée je ne comprends pas "RSIT" ?
                7. Nic00
                  Ouvre ton bloc note:
                  >>Démarrer >>Tous les programmes >> Accessoires >>Bloc-notes
                  et copies/colles le contenu ci dessous: 

                  File::
c:\program files\winsudate\gibusr.exe


                  #Va en haut de la page et clique sur le menu "Fichier"
                  #Choisis "Enregistrer sous" et choisis "Bureau"
                  #Dans le champs "Nom du fichier" en bas de page donne le nom suivant:CFScript
                  #Clique sur le bouton "Enregistrer" à droite du champ "nom du fichier"
                  #Quitte le Bloc Notes.
                  #Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe

                  #Patiente le temps du scan.Le bureau va disparaitre à plusieurs reprises: c'est normal.
                  #Ne touche à rien tant que le scan n'est pas terminé.
                  # Une fois le scan achevé, un rapport va s'afficher: poste son contenu.
                  # Si le fichier n'apparait pas, il se trouve ici --> C:\ComboFix.txt
                  1. lylas31
                    Voici le nouveau rapport suite à l'execution de combofix:

                    ComboFix 09-07-14.08 - Pascal 18/07/2009 16:16.2.2 - NTFSx86
                    Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.2047.1511 [GMT 2:00]
                    Running from: c:\documents and settings\Pascal.ADMIN.000\Bureau\ComboFix.exe
                    Command switches used :: c:\documents and settings\Pascal.ADMIN.000\Bureau\CFScript.txt
                    AV: avast! antivirus 4.8.1335 [VPS 090717-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

                    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

                    FILE ::
                    "c:\program files\winsudate\gibusr.exe"
                    .

                    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
                    .

                    c:\program files\winsudate\gibusr.exe

                    .
                    ((((((((((((((((((((((((( Files Created from 2009-06-18 to 2009-07-18 )))))))))))))))))))))))))))))))
                    .

                    2009-07-18 09:34 . 2009-07-18 09:34 -------- d-----w- c:\documents and settings\Pascal.ADMIN.000\Local Settings\Application Data\Temp
                    2009-07-15 18:50 . 2009-07-15 19:06 -------- d-----w- c:\program files\Ad-remover
                    2009-07-15 18:48 . 2009-07-18 09:01 -------- d-----w- C:\SmitfraudFix
                    2009-07-15 18:43 . 2009-07-15 18:35 1885088 ----a-w- C:\SmitfraudFix.exe
                    2009-07-15 16:53 . 2009-07-15 16:53 -------- d-----w- c:\documents and settings\Pascal.ADMIN.000\Application Data\Malwarebytes
                    2009-07-15 16:53 . 2009-07-13 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
                    2009-07-15 16:53 . 2009-07-15 16:53 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
                    2009-07-15 16:53 . 2009-07-15 16:53 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
                    2009-07-15 16:53 . 2009-07-13 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
                    2009-07-15 16:27 . 2009-07-15 16:27 -------- d-----w- c:\program files\trend micro
                    2009-07-15 16:27 . 2009-07-15 16:27 -------- d-----w- C:\rsit
                    2009-07-15 16:05 . 2009-07-15 16:05 -------- d-----w- c:\documents and settings\Pascal.ADMIN.000\Application Data\Yahoo!
                    2009-07-15 16:05 . 2009-07-15 16:05 -------- d-----w- c:\program files\CCleaner
                    2009-07-13 06:33 . 2009-07-13 06:33 -------- d-----w- c:\documents and settings\LocalService.AUTORITE NT.000\Application Data\Logitech
                    2009-07-10 14:04 . 2009-07-10 14:04 -------- d-----w- c:\program files\wletmin
                    2009-07-10 12:41 . 2009-07-10 12:32 344064 ----a-w- c:\documents and settings\Pascal.ADMIN.000\Application Data\InstallShield Installation Information\{4B35F00C-E63D-40DC-9839-DF15A33EAC46}\_setup.dll
                    2009-07-10 12:33 . 2002-12-02 20:33 107512 ----a-w- c:\documents and settings\Pascal.ADMIN.000\Application Data\InstallShield Installation Information\{4B35F00C-E63D-40DC-9839-DF15A33EAC46}\setup.exe
                    2009-07-10 12:33 . 2009-07-10 12:33 -------- d-----w- c:\documents and settings\Pascal.ADMIN.000\Application Data\InstallShield Installation Information
                    2009-07-07 18:33 . 2009-07-07 18:34 -------- d-----r- c:\documents and settings\LocalService.AUTORITE NT.000\Mes documents
                    2009-07-07 18:33 . 2009-07-07 18:34 -------- d-----r- c:\documents and settings\LocalService.AUTORITE NT.000\Favoris
                    2009-07-07 18:33 . 2009-07-07 18:33 -------- d-----w- c:\documents and settings\LocalService.AUTORITE NT.000\Menu Démarrer
                    2009-07-07 18:33 . 2009-07-07 18:33 -------- d-----w- c:\documents and settings\LocalService.AUTORITE NT.000\Bureau
                    2009-07-07 18:32 . 2009-07-18 14:21 -------- d-----w- c:\program files\Winsudate
                    2009-07-07 18:32 . 2009-07-07 18:34 -------- d-----w- c:\program files\Letmin
                    2009-07-07 18:32 . 2009-07-07 18:32 -------- d-----w- c:\documents and settings\Pascal.ADMIN.000\Application Data\Icones
                    2009-06-29 16:36 . 2009-06-29 16:36 37345 ----a-r- c:\documents and settings\Pascal.ADMIN.000\Application Data\Microsoft\Installer\{49E597BA-63D3-4936-9E02-AEDB5D1FE002}\controlPanelIcon.exe
                    2009-06-29 16:36 . 2009-06-29 16:36 10134 ----a-r- c:\documents and settings\Pascal.ADMIN.000\Application Data\Microsoft\Installer\{49E597BA-63D3-4936-9E02-AEDB5D1FE002}\SystemFolder_msiexec.exe
                    2009-06-27 17:10 . 2008-11-17 09:40 261632 ----a-w- c:\windows\system32\mcdvd_32.dll
                    2009-06-27 15:50 . 2009-06-27 17:11 -------- d-----w- c:\documents and settings\Pascal.ADMIN.000\Application Data\AVS4YOU
                    2009-06-27 15:50 . 2009-06-27 15:50 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\AVS4YOU
                    2009-06-27 15:50 . 2009-06-27 15:50 -------- d-----w- c:\program files\Fichiers communs\AVSMedia
                    2009-06-27 15:50 . 2009-01-28 18:49 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
                    2009-06-27 15:50 . 2009-06-27 17:11 -------- d-----w- c:\program files\AVS4YOU

                    .
                    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
                    .
                    2009-07-17 18:28 . 2008-03-28 20:16 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Google Updater
                    2009-07-16 19:49 . 2009-02-12 14:06 -------- d-----w- c:\documents and settings\Pascal.ADMIN.000\Application Data\ArcSoft
                    2009-07-15 20:00 . 2008-03-02 19:42 -------- d-----w- c:\program files\Yahoo!
                    2009-07-15 19:59 . 2007-12-27 18:34 -------- d--h--w- c:\program files\InstallShield Installation Information
                    2009-07-10 07:28 . 2008-12-14 11:08 -------- d-----w- c:\program files\Ubisoft
                    2009-06-30 20:33 . 2009-03-08 15:35 -------- d-----w- c:\documents and settings\Pascal.ADMIN.000\Application Data\dvdcss
                    2009-06-27 15:29 . 2008-11-11 17:51 -------- d-----w- c:\documents and settings\Pascal.ADMIN.000\Application Data\LimeWire
                    2009-06-13 12:30 . 2008-10-22 15:12 -------- d-----w- c:\program files\Fichiers communs\Blizzard Entertainment
                    2009-06-13 07:06 . 2009-02-10 10:43 -------- d-----w- c:\documents and settings\Valentin.ADMIN.000\Application Data\LimeWire
                    2009-06-13 07:05 . 2008-11-11 17:47 -------- d-----w- c:\program files\LimeWire
                    2009-06-11 15:58 . 2008-03-12 16:28 -------- d-----w- c:\program files\Atari
                    2009-06-05 17:30 . 2009-06-05 17:30 -------- d-----w- c:\program files\Fichiers communs\xing shared
                    2009-06-05 17:30 . 2008-05-04 18:37 -------- d-----w- c:\program files\Fichiers communs\Real
                    2009-06-05 17:29 . 2008-02-05 21:02 -------- d-----w- c:\program files\Google
                    2009-05-08 22:18 . 2008-02-07 20:01 189472 ----a-w- c:\windows\system32\PnkBstrB.exe
                    2009-05-08 21:20 . 2008-02-07 20:01 138168 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
                    2009-05-07 23:58 . 2004-08-05 12:00 97490 ----a-w- c:\windows\system32\perfc00C.dat
                    2009-05-07 23:58 . 2004-08-05 12:00 525228 ----a-w- c:\windows\system32\perfh00C.dat
                    2009-05-04 20:02 . 2009-04-02 20:25 152576 ----a-w- c:\documents and settings\Pascal.ADMIN.000\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
                    2009-04-30 22:44 . 2008-02-07 20:01 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
                    2009-04-30 17:18 . 2008-03-25 22:36 43616 ----a-w- c:\documents and settings\Pascal.ADMIN.000\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
                    2009-04-29 20:24 . 2009-02-14 22:06 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
                    2004-07-22 09:51 . 2004-07-22 09:51 3432656 ----a-w- c:\program files\ManagedDX.CAB
                    2004-07-19 21:58 . 2004-07-19 21:58 1156363 ----a-w- c:\program files\BDANT.cab
                    2004-07-19 21:53 . 2004-07-19 21:53 976020 ----a-w- c:\program files\BDAXP.cab
                    2004-07-09 13:17 . 2004-07-09 13:17 13265040 ----a-w- c:\program files\dxnt.cab
                    2004-07-09 08:13 . 2004-07-09 08:13 15493481 ----a-w- c:\program files\DirectX.cab
                    2004-07-09 08:13 . 2004-07-09 08:13 703080 ----a-w- c:\program files\BDA.cab
                    2004-07-09 03:08 . 2004-07-09 03:08 472576 ----a-w- c:\program files\dxsetup.exe
                    2004-07-09 03:08 . 2004-07-09 03:08 2242560 ----a-w- c:\program files\dsetup32.dll
                    2004-07-09 02:03 . 2004-07-09 02:03 62976 ----a-w- c:\program files\DSETUP.dll
                    .

                    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
                    .
                    .
                    *Note* empty entries & legit default entries are not shown
                    REGEDIT4

                    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-28 68856]
                    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-05 15360]
                    "AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-11-23 203720]
                    "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760]

                    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                    "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
                    "Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2008-04-04 88584]
                    "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
                    "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
                    "InCD"="c:\program files\Ahead\InCD\InCD.exe" [2004-02-18 1265783]
                    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
                    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
                    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
                    "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-06-05 198160]

                    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

                    c:\documents and settings\Pascal.ADMIN.000\Menu D‚marrer\Programmes\D‚marrage\
                    Nikon Monitor.lnk - c:\program files\Fichiers communs\Nikon\Monitor\NkMonitor.exe [2007-5-15 479232]

                    c:\documents and settings\All Users.WINDOWS\Menu D‚marrer\Programmes\D‚marrage\
                    KODAK Software Updater.lnk - c:\program files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-2-13 16423]
                    Logiciel Kodak EasyShare.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-2-20 282624]
                    Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-4-20 67128]
                    Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-8-14 805392]

                    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
                    2008-05-02 00:42 72208 ----a-w- c:\program files\Fichiers communs\Logishrd\Bluetooth\LBTWLgn.dll

                    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
                    @=""

                    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                    "c:\\WINDOWS\\system32\\sessmgr.exe"=
                    "c:\\Program Files\\Orange\\Connectivity\\ConnectivityManager.exe"=
                    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                    "c:\\Program Files\\Xfire\\xfire.exe"=
                    "c:\\Program Files\\MotoGP2\\motogp2.exe"=
                    "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
                    "c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
                    "c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
                    "c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
                    "c:\\Program Files\\Metin2_France\\metin2.bin"=
                    "c:\\Program Files\\LimeWire\\LimeWire.exe"=
                    "c:\\Program Files\\Messenger\\msmsgs.exe"=
                    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                    "c:\\Program Files\\Ubisoft\\Prince of Persia\\Prince of Persia.exe"=
                    "c:\\Program Files\\Ubisoft\\Prince of Persia\\PrinceOfPersia_Launcher.exe"=
                    "c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
                    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
                    "c:\\Program Files\\iTunes\\iTunes.exe"=

                    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                    "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

                    R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [08/05/2008 13:47 114768]
                    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [08/05/2008 13:47 20560]
                    R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\atl01_xp.sys [11/01/2008 14:45 38656]
                    S2 gupdate1c9e6032e0728a2;Service Google Update (gupdate1c9e6032e0728a2);c:\program files\Google\Update\GoogleUpdate.exe [05/06/2009 19:29 133104]
                    S3 SQTECH9090;TOP Cam(PID_9090_00);c:\windows\system32\drivers\Capt9090.sys [12/02/2009 18:42 48384]
                    .
                    Contents of the 'Scheduled Tasks' folder

                    2009-07-09 c:\windows\Tasks\AppleSoftwareUpdate.job
                    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

                    2009-07-18 c:\windows\Tasks\Google Software Updater.job
                    - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-03-28 16:58]

                    2009-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
                    - c:\program files\Google\Update\GoogleUpdate.exe [2009-06-05 17:29]

                    2009-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
                    - c:\program files\Google\Update\GoogleUpdate.exe [2009-06-05 17:29]
                    .
                    - - - - ORPHANS REMOVED - - - -

                    HKCU-Run-WinUsr - c:\program files\Winsudate\gibusr.exe

                    .
                    ------- Supplementary Scan -------
                    .
                    uInternet Settings,ProxyOverride = *.local
                    IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                    Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
                    .

                    **************************************************************************

                    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                    Rootkit scan 2009-07-18 16:22
                    Windows 5.1.2600 Service Pack 2 NTFS

                    scanning hidden processes ...

                    scanning hidden autostart entries ...

                    scanning hidden files ...

                    scan completed successfully
                    hidden files: 0

                    **************************************************************************
                    .
                    --------------------- LOCKED REGISTRY KEYS ---------------------

                    [HKEY_USERS\S-1-5-21-682003330-651377827-2146000999-1003\Software\SecuROM\License information*]
                    "datasecu"=hex:df,95,61,0f,9f,3d,94,c3,89,60,ea,8b,b9,9a,7b,29,b3,fa,52,8a,02,
                    1b,40,36,56,48,1b,12,fb,d9,a8,44,92,ce,82,c1,40,37,f8,6a,95,ed,87,bd,c6,e8,\
                    "rkeysecu"=hex:cb,bd,f2,61,5a,4e,c6,95,f2,29,8b,82,ba,6b,3d,44
                    .
                    --------------------- DLLs Loaded Under Running Processes ---------------------

                    - - - - - - - > 'winlogon.exe'(580)
                    c:\windows\system32\Ati2evxx.dll
                    c:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll
                    c:\program files\fichiers communs\logishrd\bluetooth\LBTServ.dll
                    .
                    Completion time: 2009-07-18 16:23
                    ComboFix-quarantined-files.txt 2009-07-18 14:23
                    ComboFix2.txt 2009-07-18 12:05

                    Pre-Run: 57 366 732 800 octets libres
                    Post-Run: 57 361 272 832 octets libres

                    190
                8. lylas31
                  voila, j'ai lancé combofix, voici le rapport :

                  ComboFix 09-07-14.08 - Pascal 18/07/2009 13:50.1.2 - NTFSx86
                  Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.2047.1452 [GMT 2:00]
                  Running from: c:\documents and settings\Pascal.ADMIN.000\Bureau\ComboFix.exe
                  AV: avast! antivirus 4.8.1335 [VPS 090717-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

                  WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
                  .

                  ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
                  .

                  c:\docume~1\PASCAL~1.000\LOCALS~1\Temp\IadHide5.dll
                  c:\documents and settings\Ava\real.txt
                  c:\documents and settings\Pascal.ADMIN.000\Local Settings\Temp\IadHide5.dll
                  c:\windows\dat.txt
                  c:\windows\Installer\1240f1.msi
                  c:\windows\Installer\1355829.msi
                  c:\windows\Installer\224e27.msi
                  c:\windows\Installer\2a45a.msi
                  c:\windows\Installer\2a461.msi
                  c:\windows\Installer\2d42e3.msi
                  c:\windows\Installer\333f4c.msi
                  c:\windows\Installer\366d21.msi
                  c:\windows\Installer\380e7c.msi
                  c:\windows\Installer\380e89.msi
                  c:\windows\Installer\380e90.msi
                  c:\windows\Installer\380e98.msi
                  c:\windows\Installer\380e9f.msi
                  c:\windows\Installer\380ea6.msi
                  c:\windows\Installer\380ead.msi
                  c:\windows\Installer\380eb4.msi
                  c:\windows\Installer\380ebb.msi
                  c:\windows\Installer\380eed.msi
                  c:\windows\Installer\380f1f.msi
                  c:\windows\Installer\380f51.msi
                  c:\windows\Installer\380f83.msi
                  c:\windows\Installer\380fb5.msi
                  c:\windows\Installer\380fe7.msi
                  c:\windows\Installer\381019.msi
                  c:\windows\Installer\38104b.msi
                  c:\windows\Installer\38107d.msi
                  c:\windows\Installer\3810af.msi
                  c:\windows\Installer\3810e1.msi
                  c:\windows\Installer\381113.msi
                  c:\windows\Installer\381145.msi
                  c:\windows\Installer\381177.msi
                  c:\windows\Installer\3811a9.msi
                  c:\windows\Installer\3811db.msi
                  c:\windows\Installer\38120d.msi
                  c:\windows\Installer\38123f.msi
                  c:\windows\Installer\381271.msi
                  c:\windows\Installer\3812a3.msi
                  c:\windows\Installer\3812d5.msi
                  c:\windows\Installer\3812dc.msi
                  c:\windows\Installer\3812e3.msi
                  c:\windows\Installer\3812ea.msi
                  c:\windows\Installer\3812f1.msi
                  c:\windows\Installer\3812f8.msi
                  c:\windows\Installer\3812ff.msi
                  c:\windows\Installer\381306.msi
                  c:\windows\Installer\38130d.msi
                  c:\windows\Installer\381314.msi
                  c:\windows\Installer\38131b.msi
                  c:\windows\Installer\381322.msi
                  c:\windows\Installer\381329.msi
                  c:\windows\Installer\381330.msi
                  c:\windows\Installer\381337.msi
                  c:\windows\Installer\38133e.msi
                  c:\windows\Installer\381345.msi
                  c:\windows\Installer\38134c.msi
                  c:\windows\Installer\381353.msi
                  c:\windows\Installer\38135a.msi
                  c:\windows\Installer\381361.msi
                  c:\windows\Installer\381368.msi
                  c:\windows\Installer\38136f.msi
                  c:\windows\Installer\381376.msi
                  c:\windows\Installer\38137d.msi
                  c:\windows\Installer\381385.msi
                  c:\windows\Installer\bb3cf.msi
                  c:\windows\Installer\c2c18f.msi
                  c:\windows\Installer\d60341.msi
                  c:\windows\Installer\d60348.msi
                  c:\windows\Installer\f79908.msi
                  c:\windows\search_res.txt
                  c:\windows\system32\Cache
                  c:\windows\system32\real.txt
                  c:\windows\system32\tmp.reg

                  .
                  ((((((((((((((((((((((((( Files Created from 2009-06-18 to 2009-07-18 )))))))))))))))))))))))))))))))
                  .

                  2009-07-18 09:34 . 2009-07-18 09:34 -------- d-----w- c:\documents and settings\Pascal.ADMIN.000\Local Settings\Application Data\Temp
                  2009-07-15 18:50 . 2009-07-15 19:06 -------- d-----w- c:\program files\Ad-remover
                  2009-07-15 18:48 . 2009-07-18 09:01 -------- d-----w- C:\SmitfraudFix
                  2009-07-15 18:43 . 2009-07-15 18:35 1885088 ----a-w- C:\SmitfraudFix.exe
                  2009-07-15 16:53 . 2009-07-15 16:53 -------- d-----w- c:\documents and settings\Pascal.ADMIN.000\Application Data\Malwarebytes
                  2009-07-15 16:53 . 2009-07-13 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
                  2009-07-15 16:53 . 2009-07-15 16:53 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
                  2009-07-15 16:53 . 2009-07-15 16:53 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
                  2009-07-15 16:53 . 2009-07-13 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
                  2009-07-15 16:27 . 2009-07-15 16:27 -------- d-----w- c:\program files\trend micro
                  2009-07-15 16:27 . 2009-07-15 16:27 -------- d-----w- C:\rsit
                  2009-07-15 16:05 . 2009-07-15 16:05 -------- d-----w- c:\documents and settings\Pascal.ADMIN.000\Application Data\Yahoo!
                  2009-07-15 16:05 . 2009-07-15 16:05 -------- d-----w- c:\program files\CCleaner
                  2009-07-13 06:33 . 2009-07-13 06:33 -------- d-----w- c:\documents and settings\LocalService.AUTORITE NT.000\Application Data\Logitech
                  2009-07-10 14:04 . 2009-07-10 14:04 -------- d-----w- c:\program files\wletmin
                  2009-07-10 12:41 . 2009-07-10 12:32 344064 ----a-w- c:\documents and settings\Pascal.ADMIN.000\Application Data\InstallShield Installation Information\{4B35F00C-E63D-40DC-9839-DF15A33EAC46}\_setup.dll
                  2009-07-10 12:33 . 2002-12-02 20:33 107512 ----a-w- c:\documents and settings\Pascal.ADMIN.000\Application Data\InstallShield Installation Information\{4B35F00C-E63D-40DC-9839-DF15A33EAC46}\setup.exe
                  2009-07-10 12:33 . 2009-07-10 12:33 -------- d-----w- c:\documents and settings\Pascal.ADMIN.000\Application Data\InstallShield Installation Information
                  2009-07-07 18:33 . 2009-07-07 18:34 -------- d-----r- c:\documents and settings\LocalService.AUTORITE NT.000\Mes documents
                  2009-07-07 18:33 . 2009-07-07 18:34 -------- d-----r- c:\documents and settings\LocalService.AUTORITE NT.000\Favoris
                  2009-07-07 18:33 . 2009-07-07 18:33 -------- d-----w- c:\documents and settings\LocalService.AUTORITE NT.000\Menu Démarrer
                  2009-07-07 18:33 . 2009-07-07 18:33 -------- d-----w- c:\documents and settings\LocalService.AUTORITE NT.000\Bureau
                  2009-07-07 18:32 . 2009-07-07 18:34 -------- d-----w- c:\program files\Letmin
                  2009-07-07 18:32 . 2009-07-07 18:32 -------- d-----w- c:\program files\Winsudate
                  2009-07-07 18:32 . 2009-07-07 18:32 -------- d-----w- c:\documents and settings\Pascal.ADMIN.000\Application Data\Icones
                  2009-06-29 16:36 . 2009-06-29 16:36 37345 ----a-r- c:\documents and settings\Pascal.ADMIN.000\Application Data\Microsoft\Installer\{49E597BA-63D3-4936-9E02-AEDB5D1FE002}\controlPanelIcon.exe
                  2009-06-29 16:36 . 2009-06-29 16:36 10134 ----a-r- c:\documents and settings\Pascal.ADMIN.000\Application Data\Microsoft\Installer\{49E597BA-63D3-4936-9E02-AEDB5D1FE002}\SystemFolder_msiexec.exe
                  2009-06-27 17:10 . 2008-11-17 09:40 261632 ----a-w- c:\windows\system32\mcdvd_32.dll
                  2009-06-27 15:50 . 2009-06-27 17:11 -------- d-----w- c:\documents and settings\Pascal.ADMIN.000\Application Data\AVS4YOU
                  2009-06-27 15:50 . 2009-06-27 15:50 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\AVS4YOU
                  2009-06-27 15:50 . 2009-06-27 15:50 -------- d-----w- c:\program files\Fichiers communs\AVSMedia
                  2009-06-27 15:50 . 2009-01-28 18:49 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
                  2009-06-27 15:50 . 2009-06-27 17:11 -------- d-----w- c:\program files\AVS4YOU

                  .
                  (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
                  .
                  2009-07-17 18:28 . 2008-03-28 20:16 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Google Updater
                  2009-07-16 19:49 . 2009-02-12 14:06 -------- d-----w- c:\documents and settings\Pascal.ADMIN.000\Application Data\ArcSoft
                  2009-07-15 20:00 . 2008-03-02 19:42 -------- d-----w- c:\program files\Yahoo!
                  2009-07-15 19:59 . 2007-12-27 18:34 -------- d--h--w- c:\program files\InstallShield Installation Information
                  2009-07-10 07:28 . 2008-12-14 11:08 -------- d-----w- c:\program files\Ubisoft
                  2009-06-30 20:33 . 2009-03-08 15:35 -------- d-----w- c:\documents and settings\Pascal.ADMIN.000\Application Data\dvdcss
                  2009-06-27 15:29 . 2008-11-11 17:51 -------- d-----w- c:\documents and settings\Pascal.ADMIN.000\Application Data\LimeWire
                  2009-06-13 12:30 . 2008-10-22 15:12 -------- d-----w- c:\program files\Fichiers communs\Blizzard Entertainment
                  2009-06-13 07:06 . 2009-02-10 10:43 -------- d-----w- c:\documents and settings\Valentin.ADMIN.000\Application Data\LimeWire
                  2009-06-13 07:05 . 2008-11-11 17:47 -------- d-----w- c:\program files\LimeWire
                  2009-06-11 15:58 . 2008-03-12 16:28 -------- d-----w- c:\program files\Atari
                  2009-06-05 17:30 . 2009-06-05 17:30 -------- d-----w- c:\program files\Fichiers communs\xing shared
                  2009-06-05 17:30 . 2008-05-04 18:37 -------- d-----w- c:\program files\Fichiers communs\Real
                  2009-06-05 17:29 . 2008-02-05 21:02 -------- d-----w- c:\program files\Google
                  2009-05-08 22:18 . 2008-02-07 20:01 189472 ----a-w- c:\windows\system32\PnkBstrB.exe
                  2009-05-08 21:20 . 2008-02-07 20:01 138168 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
                  2009-05-07 23:58 . 2004-08-05 12:00 97490 ----a-w- c:\windows\system32\perfc00C.dat
                  2009-05-07 23:58 . 2004-08-05 12:00 525228 ----a-w- c:\windows\system32\perfh00C.dat
                  2009-05-04 20:02 . 2009-04-02 20:25 152576 ----a-w- c:\documents and settings\Pascal.ADMIN.000\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
                  2009-04-30 22:44 . 2008-02-07 20:01 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
                  2009-04-30 17:18 . 2008-03-25 22:36 43616 ----a-w- c:\documents and settings\Pascal.ADMIN.000\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
                  2009-04-29 20:24 . 2009-02-14 22:06 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
                  2004-07-22 09:51 . 2004-07-22 09:51 3432656 ----a-w- c:\program files\ManagedDX.CAB
                  2004-07-19 21:58 . 2004-07-19 21:58 1156363 ----a-w- c:\program files\BDANT.cab
                  2004-07-19 21:53 . 2004-07-19 21:53 976020 ----a-w- c:\program files\BDAXP.cab
                  2004-07-09 13:17 . 2004-07-09 13:17 13265040 ----a-w- c:\program files\dxnt.cab
                  2004-07-09 08:13 . 2004-07-09 08:13 15493481 ----a-w- c:\program files\DirectX.cab
                  2004-07-09 08:13 . 2004-07-09 08:13 703080 ----a-w- c:\program files\BDA.cab
                  2004-07-09 03:08 . 2004-07-09 03:08 472576 ----a-w- c:\program files\dxsetup.exe
                  2004-07-09 03:08 . 2004-07-09 03:08 2242560 ----a-w- c:\program files\dsetup32.dll
                  2004-07-09 02:03 . 2004-07-09 02:03 62976 ----a-w- c:\program files\DSETUP.dll
                  .

                  ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
                  .
                  .
                  *Note* empty entries & legit default entries are not shown
                  REGEDIT4

                  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                  "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-28 68856]
                  "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-05 15360]
                  "AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-11-23 203720]
                  "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760]
                  "WinUsr"="c:\program files\Winsudate\gibusr.exe" [2009-07-07 63216]

                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                  "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
                  "Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2008-04-04 88584]
                  "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
                  "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
                  "InCD"="c:\program files\Ahead\InCD\InCD.exe" [2004-02-18 1265783]
                  "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
                  "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
                  "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
                  "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-06-05 198160]

                  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                  "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

                  c:\documents and settings\Pascal.ADMIN.000\Menu D‚marrer\Programmes\D‚marrage\
                  Nikon Monitor.lnk - c:\program files\Fichiers communs\Nikon\Monitor\NkMonitor.exe [2007-5-15 479232]

                  c:\documents and settings\All Users.WINDOWS\Menu D‚marrer\Programmes\D‚marrage\
                  KODAK Software Updater.lnk - c:\program files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-2-13 16423]
                  Logiciel Kodak EasyShare.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-2-20 282624]
                  Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-4-20 67128]
                  Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-8-14 805392]

                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
                  2008-05-02 00:42 72208 ----a-w- c:\program files\Fichiers communs\Logishrd\Bluetooth\LBTWLgn.dll

                  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
                  @=""

                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                  "c:\\WINDOWS\\system32\\sessmgr.exe"=
                  "c:\\Program Files\\Orange\\Connectivity\\ConnectivityManager.exe"=
                  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                  "c:\\Program Files\\Xfire\\xfire.exe"=
                  "c:\\Program Files\\MotoGP2\\motogp2.exe"=
                  "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
                  "c:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
                  "c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
                  "c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
                  "c:\\Program Files\\Metin2_France\\metin2.bin"=
                  "c:\\Program Files\\LimeWire\\LimeWire.exe"=
                  "c:\\Program Files\\Messenger\\msmsgs.exe"=
                  "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                  "c:\\Program Files\\Ubisoft\\Prince of Persia\\Prince of Persia.exe"=
                  "c:\\Program Files\\Ubisoft\\Prince of Persia\\PrinceOfPersia_Launcher.exe"=
                  "c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
                  "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
                  "c:\\Program Files\\iTunes\\iTunes.exe"=

                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                  "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

                  R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [08/05/2008 13:47 114768]
                  R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [08/05/2008 13:47 20560]
                  R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;c:\windows\system32\drivers\atl01_xp.sys [11/01/2008 14:45 38656]
                  S2 gupdate1c9e6032e0728a2;Service Google Update (gupdate1c9e6032e0728a2);c:\program files\Google\Update\GoogleUpdate.exe [05/06/2009 19:29 133104]
                  S3 SQTECH9090;TOP Cam(PID_9090_00);c:\windows\system32\drivers\Capt9090.sys [12/02/2009 18:42 48384]
                  .
                  Contents of the 'Scheduled Tasks' folder

                  2009-07-09 c:\windows\Tasks\AppleSoftwareUpdate.job
                  - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

                  2009-07-18 c:\windows\Tasks\Google Software Updater.job
                  - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-03-28 16:58]

                  2009-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
                  - c:\program files\Google\Update\GoogleUpdate.exe [2009-06-05 17:29]

                  2009-07-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
                  - c:\program files\Google\Update\GoogleUpdate.exe [2009-06-05 17:29]
                  .
                  - - - - ORPHANS REMOVED - - - -

                  HKCU-Run-Pascal - c:\documents and settings\Pascal.ADMIN.000\Pascal.ADMIN.000.exe
                  HKLM-Run-Regedit32 - c:\windows\system32\regedit.exe

                  .
                  ------- Supplementary Scan -------
                  .
                  uInternet Settings,ProxyOverride = *.local
                  IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
                  Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
                  .

                  **************************************************************************

                  catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                  Rootkit scan 2009-07-18 14:00
                  Windows 5.1.2600 Service Pack 2 NTFS

                  scanning hidden processes ...

                  scanning hidden autostart entries ...

                  scanning hidden files ...

                  scan completed successfully
                  hidden files: 0

                  **************************************************************************
                  .
                  --------------------- LOCKED REGISTRY KEYS ---------------------

                  [HKEY_USERS\S-1-5-21-682003330-651377827-2146000999-1003\Software\SecuROM\License information*]
                  "datasecu"=hex:df,95,61,0f,9f,3d,94,c3,89,60,ea,8b,b9,9a,7b,29,b3,fa,52,8a,02,
                  1b,40,36,56,48,1b,12,fb,d9,a8,44,92,ce,82,c1,40,37,f8,6a,95,ed,87,bd,c6,e8,\
                  "rkeysecu"=hex:cb,bd,f2,61,5a,4e,c6,95,f2,29,8b,82,ba,6b,3d,44
                  .
                  --------------------- DLLs Loaded Under Running Processes ---------------------

                  - - - - - - - > 'winlogon.exe'(580)
                  c:\windows\system32\Ati2evxx.dll
                  c:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll
                  c:\program files\fichiers communs\logishrd\bluetooth\LBTServ.dll

                  - - - - - - - > 'explorer.exe'(3364)
                  c:\program files\Logitech\SetPoint\lgscroll.dll
                  c:\windows\system32\WPDShServiceObj.dll
                  c:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
                  c:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
                  c:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_fre.nlr
                  c:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
                  c:\windows\system32\PortableDeviceTypes.dll
                  c:\windows\system32\PortableDeviceApi.dll
                  .
                  ------------------------ Other Running Processes ------------------------
                  .
                  c:\windows\system32\ati2evxx.exe
                  c:\program files\Ahead\InCD\incdsrv.exe
                  2. lylas31
                    j'ai un souci dès l'étape de suppression du dossier Winsudate , le message suivant apparait

                    "impossible de supprimer gibsvc.exe, acces refuse .
                    verifier que le disque n est pas plein ou protege en ecriture et que le fichier n est pas utilisé "
                    1. Nic00
                      Clique sur le Menu Démarrer puis Exécuter, dans le champs tape : 
                      SC delete WinSvc

                      Et supprime le dossier suivant (en gras) : C:\Program Files\Winsudate

                      #########################COMBOFIX !#######################

                      ▶ /!\ Désactive ton antivirus et tout autre type de protection ! /!\
                      ▶ /!\ Déconnecte toi et ferme toutes les applications en cours (y compris Internet) ! /!\
                      ▶ Si tu es sous Vista désactive l'UAC le temps de la désinfection :
                      https://www.zebulon.fr/astuces/pratique/220-desactiver-l-uac-dans-vista.html

                      /!\ si tu as TeaTimer (le résident de Spybot), désactive-le sinon il va gêner la désinfection en empêchant la modification des BHO et la réparation du registre :
                      *Démarre Spybot, clique sur Mode, coche Mode avancé
                      *A gauche, clique sur Outils, puis sur Résident
                      *Décoche la case devant Résident "TeaTimer" puis quitte Spybot :
                      ▶ Une fois la désinfection terminée ( et pas avant ), réactive le " TeaTimer " .

                      ▶Télécharge ComboFix de sUBs :

                      http://download.bleepingcomputer.com/sUBs/ComboFix.exe

                      ▶Sauvegarde le sur ton bureau et pas ailleurs !

                      ▶ Double-clique sur ComboFix.exe Il va te poser une question, suis les invites puis attends que Combofix ait terminé, il est possible que ton PC reboot, c’est normal, un rapport sera créé.

                      ▶Poste le rapport qui se trouve ici: C:\Combofix.txt

                      ▶ clique dessus pour l'ouvrir puis clique droit >>copier
                      ▶Et dans ta prochaine réponse : clique droit >> coller

                      • 1
                      • 2