Mal-vundog
brigittedu62 -  
Bonjour,
je suis le conseil d'electricien 69 je poste un nouveau message

meme souci avec scan trend micro trouver ce virus mal_vundog dans C:\windows\system32\cbeeg.bak2

j'ai fait plusieurs scans avec
malwarebytes :rien
avast:rien
bitdefender : rien

j'ai été dans regedit et j'ai supprime une cle cbeeg.bak2

je scan a nouveau pour voir je vous tiens au courant

toujours pareil toujours ce virus???j'attends vos conseil

--
merci 
Brigitte
Configuration: Windows XP
Firefox 3.5.1

20 réponses

Résumé de la discussion

La discussion porte sur une infection signalée par le runtime mal_vundog dans C:\windows\system32\cbeeg.bak2, persistant malgré plusieurs scans et même après suppression manuelle d'une clé de registre. Des éléments de réponse suggèrent des approches variées, notamment la poursuite des instructions trouvées en regedit et l'usage d'outils comme ComboFix pour nettoyer et rapporter l'infection. Le rapport ComboFix partagé détaille des suppressions et des restaurations, notamment la restauration de sfcfiles.dll à partir du cache et la suppression de nombreux éléments dans le dossier DinerDash et autres emplacements. En cas de doute, la suite conseille un contrôle complémentaire et l'adoption de mesures de sécurité renforcées pour éviter d'autres infections, sans annoncer une conclusion sur l'état réel du problème.

Bobot (l’IA à votre service)
  1. plopus Contributeur sécurité
    salut electricien

    je viens de regarder son RSIT et franchement c'est vrai qu'il n'y a rien d'actif de VISIBLE juste un service stoppé a supprimé

    jme demande meme pourqu'oi jvoulais lui faire passer USBfix ??

    apparament jvoulais voir un truc j'ai mit "pour verfi" mais la jvoit pas...

    bonne soirée

    P.S : brigitte mets au moins en résolu et suit le tuto de antivir que eletricien ta donné @+
    1. Utilisateur anonyme
      re,
      ne t'inquiette pas, il y a juste à remplacer avast par antivir et le configurer comme il faut.
      puis fixer avec hijackthis, si elle le souhaite, les processus inutils

      sur ce bonne soirée ;-)
  2. Utilisateur anonyme
    salut plopus,
    sur le poste 10, elle nous dit d'avoir plus de problème, il s'est passé quelque chose!!!!
    peut être un miracle, nostradamus est passé par là ou sa machine est passée par LOURDE !!!!

    message pour brigittedu62,
    si tu veux qu'on regarde ton pc de près et que tu n'ais plus de problème avec une bonne protection, il faut nous le dire.
    le contenu de ton pc ne nous regarde pas,
    tu nous as solicité pour t'aider, au moins prends le temps d'aller jusqu'au bout, c'est dans ton interêt.

    sur ce et si tu ne souhaites pas continuer, au moins remaplace avast par antivir .

    bonne soirée et à + ;-)
    1. plopus Contributeur sécurité
      salut a vous 2 ;)

      brigitte a la place de te poser des questions sur les antivirus, tu ferais mieux de t'occuper de ce que tu as sur ton PC...
      1. brigittedu62 Auteur
        bonjour,
        ne vous mettez pas en colére je demande des conseils rien d'autre je suis novice alors j'essaie d'apprendre
        a bientot
    2. Utilisateur anonyme
      d'accord avec toi, il faut le laisser au niveau moyen, je réctifie : )
      2. plopus Contributeur sécurité
        par contre si jpeux me permettre ceci n'est pas trés avantageux :

        - Cocher "Heuristique de MacroVirus" et "Heuristique fichier Win32" avec degré d'identification ELEVE !

        - Cocher "Heuristique de MacroVirus" et "Heuristique fichier Win32" avec degré d'indentification ELEVE !

        car en cochant cette case tu auras + de faux positif

        @+
        1. plopus Contributeur sécurité
          cool merci :)

          a l'occasion je m'en servirai mais jprefere demandé avant ;)
          1. Utilisateur anonyme
            bien sur, j'en ai d'autres si tu veux, je les ai recuperé ailleur moi aussi, lol

            si tu as besoin d'autres canned, fais moi signe en mp

            @+ mon ami
            1. plopus Contributeur sécurité
              hello électricien

              je doute que brigitte revienne meme si il en a besoin....

              mais sympa la config de antivir j'ai toujours pas de canned pour sa, jpeux te piquer le tiens ? ;)
              1. brigittedu62 Auteur
                coucou,
                pour vous ré pondre,si , je viendrai encore vous voir ,on a toujours besoin de conseils lol
                d'ailleurs une petite question, est ce que avast et malwarsbytes suffisent, question sécurité
                est ce qu'un firewall est nécessaire?genre zone alarme?
                a bientot
              2. Utilisateur anonyme
                @brigittedu62bonjour,
                je suppose que tu as avira.
                avira en complèment avec parfeu zonalarm et MBAM sont largement suffisant pour le nettoyage de ton pc

                Bonne journée
              3. brigittedu62 Auteur
                @Utilisateur anonymere,
                non je n'ai pas avira?
                j'ai avast familiale, malwarebytes et c'est tout?
                cela n'est pas suffisant?
              4. Utilisateur anonyme
                @brigittedu62re,
                lis ceci et tu comprendras :

                Pourquoi changer ? :Avast Vs Antivir :
                Un point sur les antivirus : http://forum.malekal.com/ftopic3123.php
                Antivir VS Avast! http://forum.malekal.com/ftopic3528.php
              5. brigittedu62 Auteur
                @Utilisateur anonymere
                merci pour tout j'ai desinstaller avast et installer antivir que j'avais avant mais comme il était en anglais dur
                je vous remercie et j'espere que maintenant je suis proteger lol
            2. Utilisateur anonyme
              re,
              un complement aux messages de mon ami plopus :
              juste une chose à faire,
              j'ai vu emule sur ton rapport, peu importe ce que tu fais mais rempalce avast par antivir et configure le comme ceci :
              Configuration de Antivir :

              clic droit sur son icône dans la barre des taches et sélectionner Configurer Antivir.
              * Dans l'onglet Protection Locale, choisis Contrôler.
              * Active la recherche de rootkits via le + de Recherche de Rootkits, puis dans Sélection manuelle, coche tout (tes partitions de disque dur).
              * Clique sur la loupe du milieu pour lancer le scan en tant qu'Administrateur
              cocher la case : Mode Expert.

              => Cliquer sur Scanner dans le volet de gauche :

              > Dans "Fichiers" sélectionner Tous les fichiers.

              > Dans procédure de recherche, cocher Autoriser l'arrêt, et dans "priorité scanner" sélectionner Elevé.

              > Dans "Autres réglages" cocher toutes les cases.

              NE SURTOUT PAS OUBLIER LA RECHERCHE DES ROOTKIT QUI EST TRES IMPORTANTE !

              => Cliquer sur "Recherche" dans le volet de gauche et appliquer les mêmes paramètres que précédemment.

              => Dérouler "Recherche" en cliquant sur le +. Cliquer sur "Heuristique" :

              > Cocher "Heuristique de MacroVirus" et "Heuristique fichier Win32" avec degré d'indentification ELEVE !

              => Dans le volet de gauche, dérouler "Guard" puis dérouler "Recherche" :

              > Cocher "Heuristique de MacroVirus" et "Heuristique fichier Win32" avec degré d'identification ELEVE !

              bon surf !!!
              1. plopus Contributeur sécurité
                re

                si tu le dit tant mieux meme si m' étonnerai...
                2. brigittedu62
                  re,
                  je pense avoir resolu le probleme j'ai ete dans regedit et j'ai suivi les instruction du forum merci
                  1. brigittedu62 Auteur
                    re j'ai un nouveau probleme:
                    dans tuneup on me signale qu'i faut que je desactive les partages administratifs?
                    que dois je faire
                    1. brigittedu62 Auteur
                      re
                      j'ai fait ce que tu as dis pour norton
                      je ne pense pas devoir le reinstaller vu que je ne m'en sert pas?
                      d'autre part est ce que je suis obligé de faire ce que tu as dit avec usbfix ,car je n'ai rien connecter via usb
                      merci pour tous tes conseils
                      merci 
                      Brigitte
                      1. plopus Contributeur sécurité
                        bon ben combofix a fait un sacré menage, il reste quelques truc :

                        deja supprime les traces d enorton a l'aide de ceci :

                        http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20050414110429924

                        ensuite fait ceci pour voir une chose :

                        * Telecharge UsbFix de C_XX & Chiquitine29
                        http://sd-1.archive-host.com/membres/up/127028005715545653/UsbFix.exe
                        * Lance l installation avec les parametres par default
                        * Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d'avoir été infectés sans les ouvrir
                        * Double clic sur le raccourci UsbFix sur ton bureau
                        * Choisi l'option 1 (recherche)
                        * Laisse travailler l'outil
                        * Ensuite post le rapport UsbFix.txt qui apparaîtra
                        * Note : le rapport UsbFix.txt est sauvegardé a la racine du disque

                        * Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.
                        Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus.
                        Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus
                        1. brigittedu62 Auteur
                          2eme rapport
                          info.txt logfile of random's system information tool 1.06 2009-07-26 11:55:28

                          ======Uninstall list======

                          -->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
                          -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
                          2500 Lettres, Contrats et Actes Types-->C:\WINDOWS\IsUn040c.exe -f"C:\Program Files\The Learning Company\2500 Lettres\Uninst.isu"
                          ABBYY FineReader 5.0 Sprint-->MsiExec.exe /X{D1696920-9794-4BBC-8A30-7A88763DE5A2}
                          Acer eConsole-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EC028E6B-F3F1-4192-B63E-A7C97302ED5A}\setup.exe" -l0x40c
                          Acer eMode Management-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{65CDEC30-4BF4-48FB-8059-9FC480E4E94F}\setup.exe" -l0x40c
                          Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
                          Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
                          Adobe Reader 9.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
                          Adobe Shockwave Player-->C:\WINDOWS\system32\MACROMED\SHOCKW~2\UNWISE.EXE C:\WINDOWS\system32\MACROMED\SHOCKW~2\INSTALL.LOG
                          Agere Systems PCI Soft Modem-->agrsmdel
                          ALUpdate-->"C:\Program Files\ESTsoft\ALUpdate\unins000.exe"
                          ALZip-->"C:\Program Files\ESTsoft\ALZip\unins000.exe"
                          Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
                          Assistant de connexion Windows Live-->MsiExec.exe /I{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}
                          avast! Antivirus-->C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
                          CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
                          CDBurnerXP-->"C:\Program Files\CDBurnerXP\unins000.exe"
                          CDDRV_Installer-->MsiExec.exe /I{0C826C5B-B131-423A-A229-C71B3CACCD6A}
                          Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
                          Correctif pour Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
                          Détecteur de flux Windows Live Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{EFFCB0F1-CFEC-48D4-B793-EBFCAE852976}
                          Digital Photo Navigator 1.5-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CF9CD37C-E29A-11D5-AE3D-005004B8E30C}\setup.EXE" -l0x9
                          eMule-->"C:\Program Files\eMule\Uninstall.exe"
                          erLT-->MsiExec.exe /I{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}
                          Extension de Windows Live Toolbar (Windows Live Toolbar)-->MsiExec.exe /X{0CA6047C-D28B-4295-834A-07C52BA20C2D}
                          Galerie de photos Windows Live-->MsiExec.exe /X{44E54A81-9D91-4AA1-9417-80AFF134F5FF}
                          Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_9DE96A29E721D90A.exe" /uninstall
                          Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
                          HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
                          Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
                          Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
                          HouseCall 6.6-->"C:\Documents and Settings\brigitte\Application Data\HouseCall 6.6\uninstaller.exe"
                          Imikimi Plugin-->"C:\Program Files\Imikimi\uninstall.exe"
                          Indeo® software-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Intel\Indeo\Uninst.isu" -c"C:\Program Files\Intel\Indeo\SavedSystemFiles\indounin.dll"
                          Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
                          Installation Windows Live-->MsiExec.exe /I{7370DF47-B4F9-4279-BFC3-3F09919F720D}
                          Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216012FF}
                          Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
                          Java(TM) SE Runtime Environment 6 Update 1-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
                          Junk Mail filter update-->MsiExec.exe /I{4DE3E3D9-AE81-45DE-9195-3015F7B1DBF3}
                          KhalInstallWrapper-->MsiExec.exe /I{3101CB58-3482-4D21-AF1A-7057FC935355}
                          L&H TTS3000 Français-->RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\LHTTSFRF.inf, Uninstall
                          Learn2 Player (Uninstall Only)-->C:\Program Files\Learn2.com\StRunner\stuninst.exe
                          Lecteur Windows Media 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
                          Lexmark X1100 Series-->C:\WINDOWS\system32\spool\drivers\w32x86\3\LXBKUN5C.EXE -dLexmark X1100 Series
                          LiveUpdate 2.5 (Symantec Corporation)-->C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE /U
                          Logiciel QuickCam de Logitech-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C43048A9-742C-4DAD-90D2-E3B53C9DB825}\setup.exe" -l0x40c
                          Logitech Print Service-->C:\PROGRA~1\LOGITECH\PRINTS~1\UNWISE.EXE C:\PROGRA~1\LOGITECH\PRINTS~1\INSTALL.LOG
                          Logitech SetPoint-->C:\Program Files\InstallShield Installation Information\{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}\setup.exe -runfromtemp -l0x040c -removeonly
                          Logitech Updater-->MsiExec.exe /I{53735ECE-E461-4FD0-B742-23A352436D3A}
                          Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
                          Menus intelligents (Windows Live Toolbar)-->MsiExec.exe /X{0CC70FEF-5068-4CD5-B4DE-86FFD98EC929}
                          Messenger Plus! Live-->"C:\Program Files\Messenger Plus! Live\Uninstall.exe"
                          Microsoft .NET Framework 1.1 French Language Pack-->MsiExec.exe /X{9A394342-4A68-4EBA-85A6-55B559F4E700}
                          Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
                          Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
                          Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
                          Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - FRA-->MsiExec.exe /I{3F7924B9-D148-3141-87B1-68F36043A940}
                          Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
                          Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
                          Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
                          Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
                          Microsoft ActiveSync 3.8-->"C:\WINDOWS\ISUN040C.EXE" -f"C:\Program Files\Microsoft ActiveSync\DeIsL1.isu" -c"C:\Program Files\Microsoft ActiveSync\ceuninst.dll"
                          Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
                          Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
                          Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
                          Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
                          Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
                          Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
                          Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
                          Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0044-040C-0000-0000000FF1CE} /uninstall {AE187E0D-EBA5-4EE1-A397-BF1A577CB24C}
                          Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {B165D3C2-40AE-4D39-86F7-E5C87C4264C0}
                          Microsoft Office Access MUI (French) 2007-->MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
                          Microsoft Office Excel MUI (French) 2007-->MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
                          Microsoft Office InfoPath MUI (French) 2007-->MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
                          Microsoft Office Outlook Connector-->MsiExec.exe /I{95120000-0122-040C-0000-0000000FF1CE}
                          Microsoft Office Outlook MUI (French) 2007-->MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
                          Microsoft Office PowerPoint MUI (French) 2007-->MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
                          Microsoft Office Professional Plus 2007-->"C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
                          Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
                          Microsoft Office Proof (Arabic) 2007-->MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
                          Microsoft Office Proof (Dutch) 2007-->MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
                          Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
                          Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
                          Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
                          Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
                          Microsoft Office Proofing (French) 2007-->MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
                          Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {14809F99-C601-4D4A-9391-F1E8FAA964C5}
                          Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {A0516415-ED61-419A-981D-93596DA74165}
                          Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
                          Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}
                          Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {D66D5A44-E480-4BA4-B4F2-C554F6B30EBB}
                          Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}
                          Microsoft Office Publisher MUI (French) 2007-->MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
                          Microsoft Office Shared MUI (French) 2007-->MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
                          Microsoft Office Word MUI (French) 2007-->MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
                          Microsoft Search Enhancement Pack-->MsiExec.exe /X{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}
                          Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
                          Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
                          Microsoft Sync Framework Runtime Native v1.0 (x86)-->MsiExec.exe /I{8A74E887-8F0F-4017-AF53-CBA42211AAA5}
                          Microsoft Sync Framework Services Native v1.0 (x86)-->MsiExec.exe /I{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}
                          Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB928090)-->"C:\WINDOWS\ie7updates\KB928090-IE7\spuninst\spuninst.exe"
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB929969)-->"C:\WINDOWS\ie7updates\KB929969\spuninst\spuninst.exe"
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB931768)-->"C:\WINDOWS\ie7updates\KB931768-IE7\spuninst\spuninst.exe"
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB933566)-->"C:\WINDOWS\ie7updates\KB933566-IE7\spuninst\spuninst.exe"
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB937143)-->"C:\WINDOWS\ie7updates\KB937143-IE7\spuninst\spuninst.exe"
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB938127)-->"C:\WINDOWS\ie7updates\KB938127-IE7\spuninst\spuninst.exe"
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB939653)-->"C:\WINDOWS\ie7updates\KB939653-IE7\spuninst\spuninst.exe"
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB942615)-->"C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe"
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB944533)-->"C:\WINDOWS\ie7updates\KB944533-IE7\spuninst\spuninst.exe"
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB963027)-->"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe"
                          Mise à jour de sécurité pour Windows Internet Explorer 7 (KB969897)-->"C:\WINDOWS\ie7updates\KB969897-IE7\spuninst\spuninst.exe"
                          Mise à jour de sécurité pour Windows Internet Explorer 8 (KB969897)-->"C:\WINDOWS\ie8updates\KB969897-IE8\spuninst\spuninst.exe"
                          Mise à jour pour Windows Internet Explorer 8 (KB971180)-->"C:\WINDOWS\ie8updates\KB971180-IE8\spuninst\spuninst.exe"
                          Mozilla Firefox (3.5.1)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
                          MSN Pictures Displayer 4.6-->"C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe" /U
                          MSVC80_x86-->MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27}
                          MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
                          MSXML 4.0 SP2 (KB925672)-->MsiExec.exe /I{A9CF9052-F4A0-475D-A00F-A8388C62DD63}
                          MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
                          MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
                          MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
                          Navigation par onglets (Windows Live Toolbar)-->MsiExec.exe /X{E916E61F-DE9D-4EAF-91E1-CEB50016326A}
                          NTI Backup NOW! 4-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{385979FE-DC4F-4140-8EAD-A59625000D72} /l1036 BUN4
                          NTI CD & DVD-Maker-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2} /l1036 CDM7
                          NTI HomeVideo-Maker-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B8A6F713-D72D-47AD-A92D-B5C0E13F98C1}\setup.exe" -l0x40c
                          Outil de téléchargement Windows Live-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
                          PhotoFiltre Studio-->"C:\Program Files\PhotoFiltre Studio\Uninst.exe"
                          Pochette Express 2-->C:\Program Files\Pochette Express 2\uninstall.exe
                          PowerCinema NE for Everio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{39CEE1F2-12B6-4C50-9131-04BFCA110578}\setup.exe" -uninstall
                          PowerDirector Express-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{EDE721EC-870A-11D8-9D75-000129760D75}\setup.exe" -uninstall
                          PowerDVD-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe" -uninstall
                          PowerProducer-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\setup.exe" -uninstall
                          Programme de gestion Camera de Logitech®-->"C:\Program Files\Fichiers communs\Logitech\QCDRV\BIN\SETUP.EXE" UNINSTALL REMOVEPROMPT
                          QuickTime-->C:\WINDOWS\unvise32qt.exe C:\WINDOWS\system32\QuickTime\Uninstall.log
                          QuickTime-->MsiExec.exe /I{C78EAC6F-7A73-452E-8134-DBB2165C5A68}
                          RealPlayer-->C:\Program Files\Fichiers communs\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
                          Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" -l0x40c -removeonly
                          Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
                          Security Update for 2007 Microsoft Office System (KB969679)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {C66E4A6C-6E07-4C63-8CCD-2493B5087C73}
                          Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
                          Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
                          Security Update for Microsoft Office Excel 2007 (KB969682)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {C03803BD-745A-46F8-8557-817DED578780}
                          Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
                          Security Update for Microsoft Office Publisher 2007 (KB969693)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {7BE67088-1EB3-4569-8E75-DDAFBF61BC4E}
                          Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
                          Security Update for Microsoft Office Word 2007 (KB969604)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {CF3D6499-709C-43D0-8908-BC5652656050}
                          Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
                          Spelling Dictionaries Support For Adobe Reader 8-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-800000000003}
                          TuneUp Utilities 2009-->MsiExec.exe /I{55A29068-F2CE-456C-9148-C869879E2357}
                          Unix Utilities for Yahoo! Widgets-->C:\Program Files\Yahoo!\Widgets\UnixUtils\uninstall.exe
                          Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
                          Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
                          Update for Microsoft Office Outlook 2007 (KB969907)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {74F98B24-AFBD-4800-9BD6-87D349B5C462}
                          Update for Outlook 2007 Junk Email Filter (kb971933)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {53C200F4-3B4B-49A5-8539-2C61F1A88CA2}
                          VCRedistSetup-->MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
                          VIA Gestionnaire de périphériques de plate-forme-->C:\PROGRA~1\FICHIE~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{20D4A895-748C-4D88-871C-FDB1695B0169}
                          VIA Rhine-Family Fast-Ethernet Adapter-->Rundll32.exe vuins32.dll,vuins32Ex $Rhine $VIA
                          VIA/S3G Display Driver-->C:\PROGRA~1\S3\UChromeP\s3minset.exe /u UChromeP.uns
                          ViaMichelin Navigation PND-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{47FF921C-E834-47A6-8CE4-F0A99CDE347F}\setup.exe" -l0x40c
                          Viewpoint Media Player-->C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u
                          VLC media player 1.0.0-->C:\Program Files\VideoLAN\VLC\uninstall.exe
                          Windows Genuine Advantage v1.3.0254.0-->MsiExec.exe /I{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}
                          Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
                          Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
                          Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
                          Windows Live Mail-->MsiExec.exe /I{63DC2DA0-2A6C-4C38-9249-B75395458657}
                          Windows Live Messenger-->MsiExec.exe /X{059C042E-796A-4ACC-A81A-ECC2010BB78C}
                          Windows Live Messenger-->MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
                          Windows Live OneCare safety scanner-->RunDll32.exe "C:\Program Files\Windows Live Safety Center\wlscCore.dll",UninstallFunction WLSC_SCANNER_PRODUCT
                          Windows Live Sync-->MsiExec.exe /X{9C5EB781-0D37-44B8-9A58-77B3E4BF5F5E}
                          Windows Live Toolbar-->MsiExec.exe /X{F7D27C70-90F5-49B9-B188-0A133C0CE353}
                          Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
                          Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
                          Windows Media Player Metering Plug-in-->MsiExec.exe /I{FA6BB8EA-E0D4-4C41-8C34-8F26E449FE13}
                          WordBiz version 1.8-->"C:\Program Files\WordBiz\unins000.exe"
                          Yahoo! Install Manager-->C:\WINDOWS\system32\regsvr32 /u C:\PROGRA~1\Yahoo!\Common\YINSTH~1.DLL
                          Yahoo! Widgets-->C:\PROGRA~1\Yahoo!\Widgets\uninstall.exe
                          Zylom Games Player Plugin-->"C:\Program Files\Zylom Games\UninstallPlugin.exe" --uninstall

                          ======Security center information======

                          AV: avast! antivirus 4.8.1335 [VPS 090725-0]

                          ======System event log======

                          Computer Name: ACER-73356C3771
                          Event Code: 7035
                          Message: Un contrôle Démarrer a correctement été envoyé au service Google Software Updater.

                          Record Number: 7823
                          Source Name: Service Control Manager
                          Time Written: 20090619054449.000000+120
                          Event Type: Informations
                          User: AUTORITE NT\SYSTEM

                          Computer Name: ACER-73356C3771
                          Event Code: 7036
                          Message: Le service Carte de performance WMI est entré dans l'état : arrêté.

                          Record Number: 7822
                          Source Name: Service Control Manager
                          Time Written: 20090619051504.000000+120
                          Event Type: Informations
                          User:

                          Computer Name: ACER-73356C3771
                          Event Code: 7036
                          Message: Le service Carte de performance WMI est entré dans l'état : en cours d'exécution.

                          Record Number: 7821
                          Source Name: Service Control Manager
                          Time Written: 20090619051504.000000+120
                          Event Type: Informations
                          User:

                          Computer Name: ACER-73356C3771
                          Event Code: 7035
                          Message: Un contrôle Démarrer a correctement été envoyé au service Carte de performance WMI.

                          Record Number: 7820
                          Source Name: Service Control Manager
                          Time Written: 20090619051504.000000+120
                          Event Type: Informations
                          User: AUTORITE NT\SYSTEM

                          Computer Name: ACER-73356C3771
                          Event Code: 7036
                          Message: Le service Explorateur d'ordinateur est entré dans l'état : arrêté.

                          Record Number: 7819
                          Source Name: Service Control Manager
                          Time Written: 20090619051459.000000+120
                          Event Type: Informations
                          User:

                          =====Application event log=====

                          Computer Name: ACER-73356C3771
                          Event Code: 0
                          Message:
                          Record Number: 16153
                          Source Name: Acer Media Server
                          Time Written: 20090129183920.000000+060
                          Event Type: Informations
                          User:

                          Computer Name: ACER-73356C3771
                          Event Code: 1001
                          Message: Vérification du système de fichiers sur C:
                          Le type du système de fichiers est FAT32.

                          L'intégrité de l'un de vos disques doit être vérifiée.
                          Vous pouvez annuler cette vérification, mais son exécution est
                          fortement recommandée.
                          Windows va maintenant vérifier le disque.
                          Le numéro de série du volume est 320D-180E
                          76177664 Ko d'espace disque au total.
                          2286048 Ko dans 1156 fichiers cachés.
                          189312 Ko dans 5883 dossiers.
                          13220128 Ko dans 60050 fichiers.
                          60482144 Ko sont disponibles.

                          32768 octets dans chaque unité d'allocation.
                          2380552 unités d'allocation au total sur le disque.
                          1890067 unités d'allocation disponibles sur le disque.

                          Record Number: 16152
                          Source Name: Winlogon
                          Time Written: 20090129183859.000000+060
                          Event Type: Informations
                          User:

                          Computer Name: ACER-73356C3771
                          Event Code: 1800
                          Message: Le service Centre de sécurité Windows a démarré.

                          Record Number: 16151
                          Source Name: SecurityCenter
                          Time Written: 20090129181958.000000+060
                          Event Type: Informations
                          User:

                          Computer Name: ACER-73356C3771
                          Event Code: 0
                          Message:
                          Record Number: 16150
                          Source Name: RichVideo
                          Time Written: 20090129181936.000000+060
                          Event Type: Informations
                          User:

                          Computer Name: ACER-73356C3771
                          Event Code: 0
                          Message:
                          Record Number: 16149
                          Source Name: Acer Media Server
                          Time Written: 20090129181923.000000+060
                          Event Type: Informations
                          User:

                          ======Environment variables======

                          "ComSpec"=%SystemRoot%\system32\cmd.exe
                          "FP_NO_HOST_CHECK"=NO
                          "NUMBER_OF_PROCESSORS"=1
                          "OS"=Windows_NT
                          "Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\PC Connectivity Solution;C:\Program Files\Fichiers communs\Ulead Systems\MPEG;C:\Program Files\ESTsoft\ALZip;C:\Program Files\QuickTime\QTSystem
                          "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
                          "PROCESSOR_ARCHITECTURE"=x86
                          "PROCESSOR_IDENTIFIER"=x86 Family 15 Model 44 Stepping 2, AuthenticAMD
                          "PROCESSOR_LEVEL"=15
                          "PROCESSOR_REVISION"=2c02
                          "TEMP"=%SystemRoot%\TEMP
                          "TMP"=%SystemRoot%\TEMP
                          "windir"=%SystemRoot%
                          "CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
                          "QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip

                          -----------------EOF-----------------
                          1. brigittedu62 Auteur
                            bonjour,
                            je t'envoie le 1er rapport
                            --Logfile of random's system information tool 1.06 (written by random/random)
                            Run by brigitte at 2009-07-26 11:54:59
                            Microsoft Windows XP Édition familiale Service Pack 3
                            System drive C: has 55 GB (74%) free of 74 GB
                            Total RAM: 1471 MB (52% free)

                            Logfile of Trend Micro HijackThis v2.0.2
                            Scan saved at 11:55:23, on 26/07/2009
                            Platform: Windows XP SP3 (WinNT 5.01.2600)
                            MSIE: Internet Explorer v8.00 (8.00.6001.18702)
                            Boot mode: Normal

                            Running processes:
                            C:\WINDOWS\System32\smss.exe
                            C:\WINDOWS\system32\winlogon.exe
                            C:\WINDOWS\system32\services.exe
                            C:\WINDOWS\system32\lsass.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                            C:\Program Files\Alwil Software\Avast4\ashServ.exe
                            C:\WINDOWS\system32\LEXBCES.EXE
                            C:\WINDOWS\system32\spoolsv.exe
                            C:\WINDOWS\system32\LEXPPS.EXE
                            C:\Program Files\acer\Acer eConsole\MediaServerService.exe
                            C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLACSD.EXE
                            C:\Program Files\Java\jre6\bin\jqs.exe
                            C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                            C:\WINDOWS\AGRSMMSG.exe
                            C:\WINDOWS\system32\VTTimer.exe
                            C:\WINDOWS\SOUNDMAN.EXE
                            C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                            C:\WINDOWS\system32\LVCOMSX.EXE
                            C:\Program Files\Java\jre6\bin\jusched.exe
                            C:\WINDOWS\system32\ctfmon.exe
                            C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                            C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                            C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
                            C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
                            C:\Program Files\CDBurnerXP\NMSAccessU.exe
                            C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
                            C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                            C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
                            C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
                            C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
                            C:\WINDOWS\System32\TUProgSt.exe
                            C:\WINDOWS\wanmpsvc.exe
                            C:\Program Files\Messenger\msmsgs.exe
                            C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                            C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                            C:\Program Files\Windows Live\Contacts\wlcomm.exe
                            C:\WINDOWS\explorer.exe
                            C:\Program Files\Mozilla Firefox\firefox.exe
                            C:\Documents and Settings\brigitte\Mes documents\Téléchargements\RSIT.exe
                            C:\Program Files\trend micro\brigitte.exe

                            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?ocid=iehp
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                            R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
                            R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
                            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                            O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
                            O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
                            O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
                            O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
                            O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
                            O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
                            O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
                            O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
                            O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file)
                            O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
                            O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
                            O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
                            O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
                            O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
                            O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
                            O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
                            O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
                            O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
                            O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
                            O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
                            O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
                            O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                            O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
                            O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                            O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                            O4 - Startup: MSN Pictures Displayer.lnk = C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
                            O4 - Startup: Yahoo! Widgets.lnk = C:\Program Files\Yahoo!\Widgets\YahooWidgets.exe
                            O9 - Extra button: Créer un Favori de l'appareil mobile - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
                            O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
                            O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
                            O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\WINDOWS\system32\shdocvw.dll
                            O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\WINDOWS\system32\shdocvw.dll
                            O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\WINDOWS\system32\shdocvw.dll
                            O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                            O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
                            O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
                            O9 - Extra button: (no name) - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - (no file)
                            O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
                            O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                            O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                            O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                            O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                            O9 - Extra button: Groom - {66F83792-DAE1-4823-8F20-ADA94B33A4FF} - C:\WINDOWS\system32\shdocvw.dll (HKCU)
                            O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
                            O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
                            O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
                            O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://brigitte1957.spaces.live.com//PhotoUpload/MsnPUpld.cab
                            O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} (MUCatalogWebControl Class) - http://www.catalog.update.microsoft.com/ClientControl/en/x86/MuCatalogWebControl.cab?1216224541015
                            O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
                            O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan8/oscan8.cab
                            O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase1140.cab
                            O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
                            O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://eu-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
                            O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
                            O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://brigitte1957.spaces.live.com/PhotoUpload/MsnPUpld.cab
                            O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} - https://www.touslesdrivers.com/index.php?v_page=29
                            O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                            O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
                            O16 - DPF: {981D847D-2C06-4FB7-A09C-4F0A48601B2C} (DiagSetup Class) - http://techcity.aol.fr/download/img/DiagSetup.cab
                            O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://securite.neuf.fr/Ols/fscax.cab
                            O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - http://www.extrafilm.fr/NET/Import/ImageUploader3.cab
                            O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
                            O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
                            O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} - http://bmm.imgag.com/imgag/cp/install/crusher-fr.cab
                            O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
                            O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                            O16 - DPF: {E1E73B44-2D20-47A9-9CA2-B534CEBBF856} (F-Secure Health Check 1.0) - https://www.sfr.fr/cas/login?service=https%3A%2F%2Fsecurite.sfr.fr%2Fadmin%2F
                            O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
                            O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\acer\Acer eConsole\MediaServerService.exe
                            O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLACSD.EXE
                            O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                            O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
                            O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                            O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                            O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                            O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
                            O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logishrd\Bluetooth\LBTServ.exe
                            O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
                            O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
                            O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
                            O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
                            O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
                            O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
                            O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
                            O24 - Desktop Component 0: (no name) - C:\Documents and Settings\brigitte\Mes documents\Mes images\brigitte\Mo.jpg
                            O24 - Desktop Component 1: (no name) - C:\Documents and Settings\brigitte\Mes documents\Mes images\brigitte\mc.jpg
                            O24 - Desktop Component 2: (no name) - C:\Documents and Settings\brigitte\Mes documents\Mes images\brigitte\morgane.jpg
                            1. plopus Contributeur sécurité
                              re brigitte je viens de voir que en fait tu avait posté sur un autre sujet deja ouvert dorenavant on continue ici :)

                              Fait ceci stp :

                              sa prends 2 min

                              Télécharge Random's System Information Tool (RSIT) de Random/Random, et enregistre le sur ton Bureau.
                              http://images.malwareremoval.com/random/RSIT.exe
                              • Double clique sur RSIT.exe pour lancer l'outil.
                              • Clique sur "Continue" à l'écran Disclaimer.
                              • Si l'outil HijackThis n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu s'il te le demande) et tu devras accepter la licence.
                              • Une fois le scan terminé, deux rapports vont apparaître : poste les dans deux messages séparés stp
                              1. brigittedu62 Auteur
                                merci
                                ,je viens d'utiliser combofix pour voir ,je te mets le rapport
                                ComboFix 09-07-25.04 - brigitte 26/07/2009 11:08.1.1 - FAT32x86
                                Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.1471.963 [GMT 2:00]
                                Running from: c:\documents and settings\brigitte\Mes documents\Téléchargements\ComboFix.exe
                                AV: avast! antivirus 4.8.1335 [VPS 090725-0] *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

                                WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
                                .

                                ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
                                .

                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\cup.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\customer_cup.png­
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\heart.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\menu_down.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\menu_up.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\plates.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\ticket.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\accessories\tray.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\music\mainmenumusic.og­g
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_bring_check_1_­snd.ogg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_deliver_food_1­_snd.ogg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_deliver_order_­1_snd.ogg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_diner.ogg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_dish_dropoff_1­_snd.ogg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_food_ready_1_s­nd.ogg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_gain_heart_1.o­gg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_get_drinks_1_s­nd.ogg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_party_arrive_1­_snd.ogg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_pencil_write_2­.ogg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_pickup_food_1_­snd.ogg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_rollover_1.ogg­
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\audio\sfx\sfx_seat_people_sn­d.ogg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\choosedifficulty­.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\credits.jpg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\flo_lose.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\flo_win.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\help1.jpg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\help2.jpg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\highscores.jpg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\levelintro.jpg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\levelintro_mask.­png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\levelover.jpg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\levelover_mask.p­ng
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\mainmenu.jpg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\popup.jpg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\popup_mask.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\upgradegrid.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\upgradetitle.png­
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\backgrounds\upsell.jpg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\arrowleft_blue.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\arrowleft_yellow.png­
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\arrowright_blue.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\arrowright_yellow.pn­g
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\back_blue.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\back_yellow.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\backchalk.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\backchalkup.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\backtomenu_blue.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\backtomenu_yellow.pn­g
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\cancel.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\cancelup.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\career.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\career_over.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\close.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\closeup.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\continue.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\continueover.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\credits_blue.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\credits_yellow.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\download_blue.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\download_yellow.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\easy.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\easy_over.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\endlessshift.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\endlessshift_over.pn­g
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\hard.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\hard_over.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\help.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\help_over.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\highscores.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\highscores_over.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\instructions_blue.pn­g
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\instructions_yellow.­png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\letsplay.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\letsplayover.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\medium.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\medium_over.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\moreinfo.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\moreinfoup.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\off.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\off_on.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\on.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\on_on.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\pause.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\pauseover.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\quit.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\quitgame.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\quitgameover.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\quitover.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\resumegame.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\resumegameover.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\submit.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\submitup.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\tryagain.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\tryagainover.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\upgrade_over.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\upgrade_up.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewglobal.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewglobalup.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewhighscore.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewhighscoreon.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewlocal.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\buttons\viewlocalup.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\comics\webcomic.jpg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\config\career.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\config\customer.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\config\endless.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\config\global.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\config\powerups.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cook\cook.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cook\cook.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cook\stove.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cursor\arrow.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cursor\click.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cursor\click2.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cursor\grab.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\cursor\open.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\anim.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\blue\anim­.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\blue\anim­.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\blue\sit_­legs.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\green\ani­m.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\green\ani­m.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\green\sit­_legs.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\purple\an­im.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\purple\an­im.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\purple\si­t_legs.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\red\anim.­png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\red\anim.­xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\red\sit_l­egs.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\yellow\an­im.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\yellow\an­im.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\old_male\yellow\si­t_legs.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\anim.­xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\blue\­anim.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\blue\­anim.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\blue\­sit_legs.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\green­\anim.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\green­\anim.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\green­\sit_legs.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\purpl­e\anim.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\purpl­e\anim.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\purpl­e\sit_legs.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\red\a­nim.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\red\a­nim.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\red\s­it_legs.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\yello­w\anim.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\yello­w\anim.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\customers\young_female\yello­w\sit_legs.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\idle.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\idle.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\lower.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\lower.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\upper.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\flo\upper.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\fonts\arial.mvec
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\fonts\komikaaxis.mvec
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\chair.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\chair.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\dirt2top.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\dirt4top.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\dishcart.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\dishcart.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\drinkstation_off.p­ng
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\drinkstation_on1.p­ng
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\drinkstation_on2.p­ng
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\ticketstation.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\furniture\ticketstation.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowdown.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowdownon.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowleft.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowlefton.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowright.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowrighton.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowup.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\arrowupon.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\p1icon.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\textedit.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\hiscore\title.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_1.txt
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_1_a.txt
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_1_b.txt
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_1_c.txt
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_2.txt
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_2_a.txt
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_2_b.txt
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_2_c.txt
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_2_d.txt
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_3.txt
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_3_a.txt
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_3_b.txt
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_3_c.txt
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\endless_1_3_d.txt
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\fifth_level_diner.tx­t
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\first_level_diner.tx­t
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\fourth_level_diner.t­xt
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\layouts\second_level_diner.t­xt
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\playfirst_logo.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\background­.jpg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food1­.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food1­.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food2­.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food2­.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food3­.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\food\food3­.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\frames\upg­rade_0001.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\tables\2to­p.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\tables\2to­p.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\tables\4to­p.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\tables\4to­p.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\diner\upgrades.x­ml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\restaurants\tableshadow.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\choosedifficulty.lua­
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\chooseplayer.lua
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\chooserestaurant.lua­
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\credits.lua
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\game.lua
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\gothighscore.lua
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\help.lua
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\help2.lua
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\hiscore.lua
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\hiscoreinfo.lua
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\hiscoresubmit.lua
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\levelintro.lua
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\levelover.lua
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\loading.lua
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\mainloop.lua
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\mainmenu.lua
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\ok.lua
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\pause.lua
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\style.lua
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\tutorialintro.lua
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\upgrade.lua
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\upsell.lua
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\webcomic.lua
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\scripts\yesno.lua
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\splash\aol_logo.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\splash\gamelabsplash.jpg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\splash\playfirst_logo.jpg
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\strings.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\angersmoke.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\angersmoke.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\chairflags.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\chairflags.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\check.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\checkmark.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\clock.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\closed.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\closingtime.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\coinflip.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\coinflip.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\dollar.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\doodles\coffee.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\doodles\tables.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\doodles\wallpaper.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\expert.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\expertscore.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\foodpoof.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\foodpoof.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\fork_timer.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\goalcompleted.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\heartgrow.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\heartgrow.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\jar.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\jar.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\level.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\level_career.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\score.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\sound.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\staroff.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\staron.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\tablenumber.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\tablenumberup.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\traynumber.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\tutorial_character.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\tutorialarrow.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\tutorialbox.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgradeanim.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgradeanim.xml
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\drinks.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\maitred.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\oven.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\select.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\shoes.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\stereo.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\assets\ui\upgrades\table.png
                                c:\windows\Downloaded Program Files\DinerDash.1.0.0.80\dinerdash.exe
                                c:\windows\Installer\103379f.msp
                                c:\windows\Installer\10337b2.msp
                                c:\windows\Installer\10337c5.msp
                                c:\windows\Installer\10337df.msp
                                c:\windows\Installer\10337e0.msp
                                c:\windows\Installer\10337e1.msp
                                c:\windows\Installer\10337f5.msp
                                c:\windows\Installer\1033808.msp
                                c:\windows\Installer\103381b.msp
                                c:\windows\Installer\103383f.msp
                                c:\windows\Installer\1033840.msp
                                c:\windows\Installer\1033853.msp
                                c:\windows\Installer\149142.msi
                                c:\windows\Installer\1b9ae29.msp
                                c:\windows\Installer\1c8e664.msp
                                c:\windows\Installer\1c8e665.msp
                                c:\windows\Installer\1c8e677.msp
                                c:\windows\Installer\2339b3.msp
                                c:\windows\Installer\2fe432.msp
                                c:\windows\Installer\32f97f.msi
                                c:\windows\Installer\4c919.msp
                                c:\windows\Installer\508af5.msp
                                c:\windows\Installer\508c4d.msp
                                c:\windows\Installer\66559.msp
                                c:\windows\Installer\7520b.msp
                                c:\windows\Installer\7520c.msp
                                c:\windows\Installer\945591.msp
                                c:\windows\Installer\945592.msp
                                c:\windows\Installer\945593.msp
                                c:\windows\Installer\945594.msp
                                c:\windows\Installer\945595.msp
                                c:\windows\Installer\9455aa.msp
                                c:\windows\Installer\9455ab.msp
                                c:\windows\Installer\9455ac.msp
                                c:\windows\Installer\9455ad.msp
                                c:\windows\Installer\9455ae.msp
                                c:\windows\Installer\9455af.msp
                                c:\windows\Installer\9455b0.msp
                                c:\windows\Installer\d570f.msp
                                c:\windows\Installer\d5710.msp
                                c:\windows\Installer\d5723.msp
                                c:\windows\Installer\e6c23.msi
                                c:\windows\pack.epk
                                c:\windows\patch.exe
                                c:\windows\system32\autorun.ini
                                c:\windows\system32\cbeeg.bak2

                                Infected copy of c:\windows\system32\sfcfiles.dll was found and disinfected
                                Restored copy from - c:\windows\system32\dllcache\sfcfiles.dll

                                .
                                ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
                                .

                                -------\Legacy_BOONTY_GAMES
                                -------\Service_Boonty Games

                                ((((((((((((((((((((((((( Files Created from 2009-06-26 to 2009-07-26 )))))))))))))))))))))))))))))))
                                .

                                2009-07-26 08:01 . 2009-07-26 08:01 183356 ----a-w- c:\documents and settings\brigitte\Application Data\HouseCall 6.6\Uninstaller.exe
                                2009-07-26 06:33 . 2009-07-26 06:33 -------- d-----w- c:\documents and settings\brigitte\Application Data\HouseCall 6.6
                                2009-07-24 10:12 . 2009-07-24 10:12 -------- d-----w- c:\program files\Imikimi
                                2009-07-19 08:08 . 2009-07-19 08:08 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL
                                2009-07-18 16:16 . 2009-07-18 16:16 -------- d-----w- c:\documents and settings\brigitte\Local Settings\Application Data\TomTom
                                2009-07-14 07:26 . 2009-07-14 07:26 -------- d-----w- c:\documents and settings\brigitte\Application Data\vlc

                                .
                                (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
                                .
                                2009-07-16 10:53 . 2008-09-21 06:34 3775176 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
                                2009-07-13 11:36 . 2008-09-21 06:33 38160 ----a-w- c:\windows\system32\drivers\mbamswissar­my.sys
                                2009-07-13 11:36 . 2008-09-21 06:33 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
                                2009-06-21 05:49 . 2009-06-21 05:48 -------- d-----w- c:\documents and settings\brigitte\Application Data\LG Electronics
                                2009-06-16 14:40 . 2005-10-17 17:13 119808 ----a-w- c:\windows\system32\t2embed.dll
                                2009-06-16 14:40 . 2005-10-17 17:13 81920 ----a-w- c:\windows\system32\fontsub.dll
                                2009-06-15 04:15 . 2009-01-24 05:02 116944 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DA­T
                                2009-06-13 04:17 . 2009-06-13 04:17 -------- d-----w- c:\program files\Microsoft.NET
                                2009-06-13 04:13 . 2009-06-13 04:13 -------- d-----w- c:\program files\Microsoft Visual Studio 8
                                2009-06-07 07:36 . 2009-05-24 14:47 603904 ----a-w- c:\windows\system32\TUProgSt.exe
                                2009-06-07 07:36 . 2009-05-16 09:16 360192 ----a-w- c:\windows\system32\TuneUpDefragServic­e.exe
                                2009-06-07 07:27 . 2009-06-07 07:27 604416 ----a-w- c:\windows\system32\TUProgSt(2).exe
                                2009-06-03 19:10 . 2005-10-17 17:13 1297408 ----a-w- c:\windows\system32\quartz.dll
                                2009-06-03 15:41 . 2005-10-17 17:13 87300 ----a-w- c:\windows\system32\perfc00C.dat
                                2009-06-03 15:41 . 2005-10-17 17:13 517764 ----a-w- c:\windows\system32\perfh00C.dat
                                2009-05-29 16:44 . 2009-05-29 16:44 -------- d-----w- c:\program files\TuneUp Utilities 2009
                                2009-05-14 13:20 . 2009-05-14 15:38 2645832 ----a-w- c:\documents and settings\brigitte\Application Data\Mozilla\Firefox\Profiles\0jirmrj6.default\extensions\{b­b628310-0ab7-11db-9cd8-0800200c9a66}\maconfsetup.exe
                                2009-05-14 12:56 . 2009-05-14 15:38 402800 ----a-w- c:\documents and settings\brigitte\Application Data\Mozilla\Firefox\Profiles\0jirmrj6.default\extensions\{b­b628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetec­tion.dll
                                2009-05-13 05:04 . 2005-10-17 17:13 915456 ----a-w- c:\windows\system32\wininet.dll
                                2009-05-07 15:33 . 2005-10-17 17:13 348672 ----a-w- c:\windows\system32\localspl.dll
                                2007-06-15 17:03 . 2007-04-20 18:12 278528 ----a-w- c:\program files\Fichiers communs\FDEUnInstaller.exe
                                2006-07-26 07:19 . 2006-07-26 07:21 774144 ----a-w- c:\program files\RngInterstitial.dll
                                2009-07-17 07:45 . 2008-06-19 15:43 137208 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
                                2007-08-29 07:16 . 2007-08-29 07:16 5 --sha-w- c:\windows\system32\ebceabd_g.dll
                                .

                                ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
                                .
                                .
                                *Note* empty entries & legit default entries are not shown
                                REGEDIT4

                                [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
                                "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
                                "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-18 68856]
                                "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE" [2005-01-19 405583]

                                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
                                "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
                                "LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184]
                                "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
                                "AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2004-04-13 88363]
                                "VTTimer"="VTTimer.exe" - c:\windows\system32\VTTimer.exe [2005-05-13 53248]
                                "SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2005-07-22 81920]

                                [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                                "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

                                c:\documents and settings\brigitte\Menu D‚marrer\Programmes\D‚marrage\
                                MSN Pictures Displayer.lnk - c:\program files\MSN Pictures Displayer\MSN Pictures Displayer.exe [2008-8-17 4713472]
                                Yahoo! Widgets.lnk - c:\program files\Yahoo!\Widgets\YahooWidgets.exe [2007-12-11 3746856]

                                [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
                                Source= c:\documents and settings\brigitte\Mes documents\Mes images\brigitte\Mo.jpg
                                FriendlyName=

                                [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
                                Source= c:\documents and settings\brigitte\Mes documents\Mes images\brigitte\mc.jpg
                                FriendlyName=

                                [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\2]
                                Source= c:\documents and settings\brigitte\Mes documents\Mes images\brigitte\morgane.jpg
                                FriendlyName=

                                [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
                                2008-05-02 00:42 72208 ----a-w- c:\program files\Fichiers communs\Logishrd\Bluetooth\LBTWLgn.dll

                                [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
                                @=""

                                [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logitech Desktop Messenger.lnk]
                                path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Logitech Desktop Messenger.lnk
                                backup=c:\windows\pss\Logitech Desktop Messenger.lnkCommon Startup

                                [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Logitech SetPoint.lnk]
                                path=c:\documents and settings\All Users\Menu Démarrer\Programmes\Démarrage\Logitech SetPoint.lnk
                                backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup

                                [HKLM\~\startupfolder\C:^Documents and Settings^brigitte^Menu Démarrer^Programmes^Démarrage^BoontyBox 01net.lnk]
                                path=c:\documents and settings\brigitte\Menu Démarrer\Programmes\Démarrage\BoontyBox 01net.lnk
                                backup=c:\windows\pss\BoontyBox 01net.lnkStartup
                                HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start
                                HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer
                                HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}
                                HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager
                                HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD
                                HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend
                                HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck
                                HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroNETTrayIcon
                                HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector
                                HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched
                                HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Symantec NetDriver Monitor
                                HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS10 Preload

                                [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
                                "Boonty Games"=3 (0x3)

                                [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
                                "ctfmon.exe"=c:\windows\system32\ctfmon.exe
                                "H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE"

                                [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
                                "MediaSync"=c:\program files\Acer\Acer eConsole\MediaSync.exe
                                "MSPY2002"=c:\windows\system32\IME\PINTLGNT\ImScInst.exe /SYNC
                                "VTTrayp"=VTtrayp.exe
                                "QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
                                "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

                                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                                "EnableFirewall"= 0 (0x0)

                                [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                                "%windir%\\system32\\sessmgr.exe"=
                                "c:\\Program Files\\eMule\\emule.exe"=
                                "c:\\WINDOWS\\System32\\FXSCLNT.exe"=
                                "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                                "c:\\Program Files\\Fichiers communs\\AOL\\ACS\\AOLAcsd.exe"=
                                "c:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"=
                                "c:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"=
                                "c:\\Program Files\\Real\\RealPlayer\\RealPlay.exe"=
                                "c:\\Program Files\\Fichiers communs\\NewTech Infosystems\\LiveUpdate\\LiveUpdate.exe"=
                                "c:\\WINDOWS\\System32\\dpvsetup.exe"=
                                "c:\\Program Files\\Messenger\\msmsgs.exe"=
                                "c:\\WINDOWS\\System32\\LEXPPS.EXE"=
                                "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
                                "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                                "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
                                "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

                                R0 ViBus;ViBus;c:\windows\system32\drivers\ViBus.sys [11/09/2008 15:44 16896]
                                R0 ViPrt;VIA SATA IDE Device Driver;c:\windows\system32\drivers\ViPrt.sys [11/09/2008 15:44 52224]
                                R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [10/09/2008 10:59 17920]
                                R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [11/09/2008 16:44 114768]
                                R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [11/09/2008 16:44 20560]
                                R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [24/05/2009 16:47 603904]
                                S3 k600bus;Sony Ericsson 600i driver (WDM);c:\windows\system32\drivers\k600bus.sys [11/05/2005 13:12 52384]
                                S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;c:\windows\system32\drivers\k600mdfl.sys [11/05/2005 13:12 6096]
                                S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;c:\windows\system32\drivers\k600mdm.sys [11/05/2005 13:12 87456]
                                S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;c:\windows\system32\drivers\k600mgmt.sys [11/05/2005 13:12 79248]
                                S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;c:\windows\system32\drivers\k600obex.sys [11/05/2005 13:12 77072]
                                S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\316.tmp --> c:\windows\system32\316.tmp [?]
                                S3 viafilter;VIA USB Filter;c:\windows\system32\drivers\viausb1.sys [11/09/2008 15:44 9728]

                                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
                                UxTuneUp

                                [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
                                "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
                                .
                                Contents of the 'Scheduled Tasks' folder

                                2009-07-26 c:\windows\Tasks\Symantec NetDetect.job
                                - c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2005-10-17 09:22]

                                2009-07-06 c:\windows\Tasks\AppleSoftwareUpdate.job
                                - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

                                2009-07-26 c:\windows\Tasks\User_Feed_Synchronization-{F354A875-81EC-49FC-9ED0-EAEE01E46853}.job
                                - c:\windows\system32\msfeedssync.exe [2006-10-17 02:31]

                                2009-07-26 c:\windows\Tasks\Maintenance en 1 clic.job
                                - c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-12 13:04]
                                .
                                .
                                ------- Supplementary Scan -------
                                .
                                uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
                                uInternet Connection Wizard,ShellNext = iexplore
                                uInternet Settings,ProxyOverride = localhost
                                uSearchURL,(Default) = hxxp://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
                                IE: E&xporter vers Microsoft Excel
                                DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan8/oscan8.cab
                                DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} - hxxp://eu-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
                                DPF: {981D847D-2C06-4FB7-A09C-4F0A48601B2C} - hxxp://techcity.aol.fr/download/img/DiagSetup.cab
                                FF - ProfilePath - c:\documents and settings\brigitte\Application Data\Mozilla\Firefox\Profiles\0jirmrj6.default\
                                FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
                                FF - prefs.js: browser.search.selectedEngine - Yahoo
                                FF - prefs.js: browser.startup.homepage - hxxp://my.numericable.fr/
                                FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=vmn&type=vendio&p=
                                FF - plugin: c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll
                                FF - plugin: c:\documents and settings\brigitte\Application Data\Mozilla\Firefox\Profiles\0jirmrj6.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
                                FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
                                FF - plugin: c:\program files\Mozilla Firefox\plugins\npkimi.dll
                                FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
                                FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
                                FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll
                                FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
                                FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
                                FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
                                FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
                                FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

                                ---- FIREFOX POLICIES ----
                                FF - user.js: network.http.max-persistent-connections-per-server - 4
                                FF - user.js: content.max.tokenizing.time - 1800000
                                FF - user.js: content.notify.interval - 600000
                                FF - user.js: content.switch.threshold - 600000
                                FF - user.js: nglayout.initialpaint.delay - 600
                                c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
                                c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
                                c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
                                c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
                                c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
                                c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
                                c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
                                c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
                                c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
                                c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
                                c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
                                c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
                                c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
                                c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
                                c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
                                c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
                                c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
                                c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
                                c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
                                .

                                **************************************************************************

                                catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                                Rootkit scan 2009-07-26 11:14
                                Windows 5.1.2600 Service Pack 3 FAT NTAPI

                                scanning hidden processes ...

                                scanning hidden autostart entries ...

                                scanning hidden files ...

                                scan completed successfully
                                hidden files: 0

                                **************************************************************************

                                [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\MEMSWEEP2]
                                "ImagePath"="\??\c:\windows\system32\316.tmp"
                                .
                                --------------------- LOCKED REGISTRY KEYS ---------------------

                                [HKEY_USERS\S-1-5-21-1570106061-833509052-641237796-1006\Software\Microsoft\SystemCertificates\AddressBook*]
                                @Allowed: (Read) (RestrictedCode)
                                @Allowed: (Read) (RestrictedCode)

                                [HKEY_USERS\S-1-5-21-1570106061-833509052-641237796-1006\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
                                "??"=hex:19,ad,66,20,94,3a,08,57,80,b9,db,18,ff,de,ce,44,eb,57,be,01,93,62,0f,
                                f1,fe,b1,01,a1,6b,de,2e,23,13,cd,c0,6a,0f,71,e4,10,f3,5c,eb,5a,ff,62,11,1c,\
                                "??"=hex:67,a4,9f,86,7b,12,9b,06,df,77,f5,9e,68,28,3f,e4

                                [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
                                "C040211900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

                                [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\h–€|ÿÿÿÿ¤•€|ù•9~*]
                                "C040211900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
                                .
                                --------------------- DLLs Loaded Under Running Processes ---------------------

                                - - - - - - - > 'winlogon.exe'(848)
                                c:\program files\fichiers communs\logishrd\bluetooth\LBTWlgn.dll
                                c:\program files\fichiers communs\logishrd\bluetooth\LBTServ.dll

                                - - - - - - - > 'explorer.exe'(3428)
                                c:\windows\system32\eappprxy.dll
                                c:\windows\system32\webcheck.dll
                                c:\windows\system32\WPDShServiceObj.dll
                                c:\windows\system32\PortableDeviceTypes.dll
                                c:\windows\system32\PortableDeviceApi.dll
                                .
                                ------------------------ Other Running Processes ------------------------
                                .
                                c:\program files\ALWIL SOFTWARE\AVAST4\ASWUPDSV.EXE
                                c:\program files\ALWIL SOFTWARE\AVAST4\ASHSERV.EXE
                                c:\windows\SYSTEM32\LEXBCES.EXE
                                c:\windows\SYSTEM32\LEXPPS.EXE
                                c:\program files\ACER\ACER ECONSOLE\MEDIASERVERSERVICE.EXE
                                c:\program files\FICHIERS COMMUNS\AOL\ACS\AOLACSD.EXE
                                c:\program files\JAVA\JRE6\BIN\JQS.EXE
                                c:\program files\FICHIERS COMMUNS\MICROSOFT SHARED\VS7DEBUG\MDM.EXE
                                c:\program files\ALWIL SOFTWARE\AVAST4\ASHDISP.EXE
                                c:\program files\CDBurnerXP\NMSAccessU.exe
                                c:\program files\CyberLink\Shared Files\RichVideo.exe
                                c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
                                c:\windows\wanmpsvc.exe
                                c:\program files\Messenger\msmsgs.exe
                                c:\program files\Alwil Software\Avast4\ashMaiSv.exe
                                c:\program files\Alwil Software\Avast4\ashWebSv.exe
                                c:\program files\Windows Live\Contacts\wlcomm.exe
                                c:\windows\system32\wscntfy.exe
                                .
                                **************************************************************************
                                .
                                Completion time: 2009-07-26 11:16 - machine was rebooted
                                ComboFix-quarantined-files.txt 2009-07-26 09:16

                                Pre-Run: 57 551 716 352 octets libres
                                Post-Run: 57 497 124 864 octets libres

                                645 --- E O F --- 2009-07-22 05:41
                                merci
                                Brigitte
                                1. plopus Contributeur sécurité
                                  Bonjour

                                  brigitte si tu as commencer une discuission avec electricien continue sur celle-ci
                                  1. Utilisateur anonyme
                                    bonsoir,
                                    je n'ai pas commencé le topic, je suis intervenu tout simplement car elle postait dans un autre topic, je lui ai tout simplement conseillé de créer son propre topic

                                    , je vois que le problème est résolu,
                                    bon surf à brigitte et bonne soirée à vous ;-)

                                Discussions similaires

                                mon pc capte mal en wifi
                                soprano2706

                                20 réponses
                                Carte roblox mal gratté illisible
                                domilulu

                                5 réponses
                                Mon PC capte mal le wifi
                                Celia-D

                                8 réponses
                                Le Wifi de mon PC portable capte mal
                                ClementCirk

                                31 réponses
                                Carte Roblox gratter trop fort
                                hbdhgfhee

                                5 réponses