Internet rame + analyse

Avant de cocher, fais ceci :

Nettoyage des outils:

▶ Télécharge ToolsCleaner par A.Rothstein & dj QUIOU sur ton Bureau:

Toolscleaner

▶ Clique sur Recherche et laisse le scan se terminer.

▶ Clique sur Suppression pour finaliser.

▶ Clique sur Quitter, pour que le rapport puisse se créer.

▶ Poste moi le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur( C:\)

=============================

▶ Télécharge CCleaner, version Slim, sans toolbar:

CCLEANER

▶ Va dans "Options">>"Avancé". Décoche la première ligne.

▶ Va dans la section "Nettoyeur". Lance l'analyse. La liste créée, lance le nettoyage deux fois de suite afin d'obtenir 0bytes supprimé!

▶ Ensuite dans "Registre", lance une recherche des erreurs. La liste créée, fais-les réparer.

▶ Recommence ensuite le cycle Recherche/Réparation des erreurs jusqu'à n'en trouver aucune lors de la recherche.

==============================

!! TRES IMPORTANT !!:

Supprimer les anciens points de restauration:

▶ Procédure sous Vista: /!\Désactive la restauration puis réactive-la /!\ Cela purgera la restauration du système.
https://www.commentcamarche.net/faq/13214-vista-desactiver-reactiver-la-restauration-systeme-de-vista

Les points sont supprimés.

Création d'un nouveau point:

▶ Procédure de création d'un point de restauration "sain" sous Vista: https://forums.cnetfrance.fr

Nomme-le par exemple: "Après désinfection ..." pour te rappeler.

========================

Pour une navigation plus sûre :

Addon à ajouter à firefox pour le sécuriser:

▶ Ici : WOT : https://addons.mozilla.org/en-US/firefox/addon/wot-safe-browsing-tool/
▶ Explications/Demo ici : http://www.mywot.com/fr/demo

+ ceux-ci: https://www.malekal.com/securiser-le-navigateur-web-firefox-2/

========================

Utile, à lire absolument, quelques minutes de prévention : https://www.malekal.com/fichiers/projetantimalwares/prevention-protection.pdf

Si tu n'as plus de soucis et/ou question, pour moi, c'est ok.

++

je n'arrive pas a le faire analyser ya beaucoup de dossier mais comme c'est un jeu en reseau super connu , je pense pas qu'il y ai de probleme

confirme moi si je coche ou pas resolu

merci

Kalof

je coche " resolu " les problèmes semble l'être

++ et vraiment merci

Kalof

RE,
je vais faire l'analyse, site internet>> "NeXon.Eu" , c'est une inscription a un jeu en réseau " combatArms " je ne c'est pas si tu connais?!
mais de ce pas , je go le faire analyser

concernant les ralentissements , je n'ai plus ce probleme , les pages s'affiche très rapidement

si tout est OK , en un mot " merci "

Kalof

Re,

Ok. Apparemment, bien supprimé. Comment va ton pc ? Tes scans ont l'air clean. Peux-tu juste vérifier ceci :

Rends-toi ici: https://www.virustotal.com/gui/

Fais analyser ce fichier, en gras, et poste le résultat : C:\ProgramData\NexonEU

++

Salut,
j'ai supprimer toolbar S&D puis réinstaller, désactiver L'UAC et mes défenses comme ultérieurement j'avais fais,
maintenant tous ce que je trouve c'est le rapport TB.txt mais qui a cause du message d'erreur ne peut finaliser ,
comme je l'ai expliquer a " Lainvi ", entre chaques nouvelles recherches d'infections, le message d'erreur s'affiche , quand je clique sur fermer programme , il ne ce ferme pas mais passe a une autre recherches d'infections et cela continuellement ( sur une durée + q'indéterminé )
il tourne en rond si tu préfère et n'aboutit pas ( 5 heures mon record !)

le voila ce fameu rapport TB.txt

-----------\\ ToolBar S&D 1.2.9 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU T5550 @ 1.83GHz )
BIOS : ZD1 v1.3809 3H09
USER : RuDy ( Administrator )
BOOT : Normal boot
Antivirus : Antivirus BitDefender 12.0 (Activated)
Firewall : Pare-feu BitDefender 12.0 (Activated)
C:\ (Local Disk) - NTFS - Total:219 Go (Free:101 Go)
D:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
Option : [1] ( 2009-08-28|20:52 )

[ UAC => 0 ]

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"SEARCH PAGE"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Local Page"="C:\\Windows\\system32\\blank.htm"
"SearchMigratedDefaultURL"="https://search.yahoo.com/web{searchTerms}&ei=utf-8&fr=b1ie7"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Default_search_url"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Url"="https://www.msn.com/fr-fr/actualite/"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.msn.com/fr-fr/"
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search bar"="http://www.bing.com/spresults.aspx"

--------------------\\ Recherche d'autres infections

Est-ce que l'UAC est bien désactivé ? Et tes protections également ?

Supprime ToolbarSD et télécharge-le à nouveau puis retente :

▶ Télécharge Toolbar-S&D (de Team IDN) sur ton Bureau

▶ Lance l'installation du programme en exécutant le fichier téléchargé.

▶ Sous Vista : Fais un clic droit sur ToolbarSD et sélectionne "Exécuter en tant qu'administrateur".

▶ Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.

▶ Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.

▶ Poste le rapport généré. (C:\TB.txt)

++

Salut,
Concernant le message d'erreur qui d'ailleurs ce génère avec l'option 1 comme la 2
le voici >>> http://img132.imageshack.us/img132/3576/toolbard.jpg
ps: aucun rapport ne ce crée car le programme ne finalise pas si tu veut :/ je n'ai donc aucune notification qui me précise que des éléments infecté ont bien été supprimé :/

voici le rapport RSIT ( Log.txt)

Logfile of random's system information tool 1.06 (written by random/random)
Run by RuDy at 2009-08-28 20:22:42
Microsoft® Windows Vista™ Édition Familiale Premium Service Pack 1
System drive C: has 104 GB (46%) free of 225 GB
Total RAM: 3070 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:23, on 2009-08-28
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18294)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\BitDefender\BitDefender 2009\seccenter.exe
C:\Program Files\Steam\Steam.exe
c:\program files\steam\steamapps\darkangel965\counter-strike source\hl2.exe
C:\Program Files\Steam\GameOverlayUI.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\RuDy\Desktop\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\RuDy.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O3 - Toolbar: Deenero - {66886C4D-B307-4ECA-A228-52CA9B9851A4} - C:\Program Files\Deenero\deenero_1,0,1,4.dll
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - (no file)
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. https://www.bitdefender.fr/ - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software - C:\Windows\System32\TuneUpDefragService.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

Ok. Est-ce que toolbar supprime bien les infections ? rappelle-moi le contenu du message d'erreur stp ?

Relance ensuite RSIT et poste le rapport log.txt.

++

re salut !

concernant l'option 2 avec toolbar S&D , il n'a généré aucun rapport , ( toujours ce foutu message qui apparait et l'empêche donc de finaliser l'opération !

maintenant je te post le rapport clennavi.txt

Fix Navipromo version 4.0.2 commencé le 2009-08-28 18:30:04.80

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!

Outil exécuté depuis C:\Program Files\navilog1

Mise à jour le 27.08.2009 à 11h00 par IL-MAFIOSO

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU T5550 @ 1.83GHz )
BIOS : ZD1 v1.3809 3H09
USER : RuDy ( Administrator )
BOOT : Normal boot

Antivirus : Antivirus BitDefender 12.0 (Activated)
Firewall : Pare-feu BitDefender 12.0 (Activated)

C:\ (Local Disk) - NTFS - Total:219 Go (Free:102 Go)
D:\ (CD or DVD)

Recherche executée en mode normal

Nettoyage exécuté au redémarrage de l'ordinateur

C:\Windows\prefetch\GAMEOVERLAYUI.EXE-82DD85B2.pf supprimé !
C:\Users\RuDy\AppData\Local\asmqy.bat supprimé !

Nettoyage contenu C:\Windows\Temp effectué !
Nettoyage contenu C:\Users\RuDy\AppData\Local\Temp effectué !

*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok

*** Scan terminé 2009-08-28 19:28:07.70 ***

Salut.

Pour tous les outils, lance-les par clic-droit puis "Exécuter en tant qu'administrateur". Également, désactive l'UAC :

Sous Vista : ▶ Désactive le contrôle des comptes utilisateurs (tu le réactiveras après ta désinfection):

▶ Clique sur Démarrer puis sur panneau de configuration
▶ Double Clique sur l'icône "Comptes d'utilisateurs"
▶ Clique ensuite sur désactiver et valide.
▶ Redémarre le PC.

===================================

Passe Toolbar, option 2. Poste le rapport.

===========Puis :=====================

Navilog 1 :

▶ Télécharge Navilog1 (de IL-MAFIOSO) et enregistre-le sur le Bureau.

http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe

▶ Double-clique sur Navilog1.exe.
(Si Vista, clique-droit >> Exécuter en tant qu'administrateur)

▶ Appuie sur F puis valide par Entrée.
▶ Appuie sur une touche de ton clavier à chaque fois que cela est demandé, tu arriveras au menu des options.
▶ Choisis l'option 1 et appuie sur la touche Entrée pour valider ton choix.
▶ Patiente le temps du scan. Il te sera peut-être demandé de redémarrer ton PC.
▶ Patiente jusqu'au message : "" Scan terminé le ..... ""
▶ Le rapport apparaît, poste-le dans ta prochaine réponse.

A noter : Le rapport se trouve également ici : C:\cleannavi.txt

++

Salut,

L'analyse avec lopR me met les même message d'erreur qu'avec ToolBar S&D , je patiente et te post le contenu du rapport très vite ( je pense qu'il sera " incomplet " )

EDIT: voila la recherches d'autres infections n'a pas aboutit !

Kalof

Rapport :

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU T5550 @ 1.83GHz )
BIOS : ZD1 v1.3809 3H09
USER : RuDy ( Administrator )
BOOT : Normal boot
Antivirus : Antivirus BitDefender 12.0 (Activated)
Firewall : Pare-feu BitDefender 12.0 (Activated)
C:\ (Local Disk) - NTFS - Total:219 Go (Free:102 Go)
D:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
Option : [1] ( 2009-08-28|16:46 )

[ UAC => 0 ]

--------------------\\ Listing des dossiers dans Local

[2009-03-05|22:09] C:\Users\RuDy\AppData\Local\acer eNM
[2009-06-06|22:53] C:\Users\RuDy\AppData\Local\Adobe
[2009-07-15|01:48] C:\Users\RuDy\AppData\Local\aedgency
[2009-05-31|02:25] C:\Users\RuDy\AppData\Local\Apple
[2009-03-05|22:07] C:\Users\RuDy\AppData\Local\Application Data
[2009-07-14|22:44] C:\Users\RuDy\AppData\Local\asmqy.bat
[2009-08-27|20:41] C:\Users\RuDy\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009-08-11|02:23] C:\Users\RuDy\AppData\Local\DMV Technologies
[2009-04-12|20:13] C:\Users\RuDy\AppData\Local\eMule
[2009-03-12|22:02] C:\Users\RuDy\AppData\Local\Eraser
[2009-07-15|17:23] C:\Users\RuDy\AppData\Local\GDIPFONTCACHEV1.DAT
[2009-03-05|22:07] C:\Users\RuDy\AppData\Local\Historique
[2009-08-28|16:34] C:\Users\RuDy\AppData\Local\IconCache.db
[2009-08-02|16:53] C:\Users\RuDy\AppData\Local\Microsoft
[2009-03-06|17:09] C:\Users\RuDy\AppData\Local\Mozilla
[2009-03-09|21:42] C:\Users\RuDy\AppData\Local\NeoSmart_Technologies
[2009-08-21|00:30] C:\Users\RuDy\AppData\Local\Ph03nixNewMedia
[2009-03-06|16:23] C:\Users\RuDy\AppData\Local\PlayMovie
[2009-03-06|17:31] C:\Users\RuDy\AppData\Local\PowerCinema
[2009-05-31|19:52] C:\Users\RuDy\AppData\Local\PunkBuster
[2009-03-09|22:54] C:\Users\RuDy\AppData\Local\Seven Zip
[2009-03-25|14:50] C:\Users\RuDy\AppData\Local\Sony
[2009-03-19|18:48] C:\Users\RuDy\AppData\Local\SRS Labs
[2009-08-28|16:46] C:\Users\RuDy\AppData\Local\temp
[2009-03-05|22:07] C:\Users\RuDy\AppData\Local\Temporary Internet Files
[2009-03-10|02:00] C:\Users\RuDy\AppData\Local\VirtualStore
[2009-08-24|22:44] C:\Users\RuDy\AppData\Local\VirtuaTennis2009
[2009-03-20|16:04] C:\Users\RuDy\AppData\Local\Yahoo
[2009-07-15|01:39] C:\Users\RuDy\AppData\Local\Zattoo
[2009-03-19|23:57] C:\Users\RuDy\AppData\Local\ZattooPlayer

--------------------\\ Tâches planifiées dans C:\Windows\tasks

[2009-08-28 16:35][--a------] C:\Windows\tasks\Maintenance en 1 clic.job
[2009-08-28 16:35][--ah-----] C:\Windows\tasks\SA.DAT
[2009-08-28 16:34][--a------] C:\Windows\tasks\SCHEDLGU.TXT

--------------------\\ Listing des dossiers dans C:\ProgramData

[2009-03-06|16:39] C:\ProgramData\{55A29068-F2CE-456C-9148-C869879E2357}
[2009-06-06|22:49] C:\ProgramData\Adobe
[2009-05-31|02:25] C:\ProgramData\Apple
[2006-11-02|15:02] C:\ProgramData\Application Data
[2009-03-09|23:55] C:\ProgramData\BitDefender
[2009-03-05|22:03] C:\ProgramData\Bureau
[2009-03-06|16:23] C:\ProgramData\CyberLink
[2009-08-15|19:54] C:\ProgramData\DAEMON Tools Lite
[2009-04-03|14:23] C:\ProgramData\DAEMON Tools Pro
[2006-11-02|15:02] C:\ProgramData\Desktop
[2006-11-02|15:02] C:\ProgramData\Documents
[2009-04-12|20:13] C:\ProgramData\eMule
[2009-03-05|22:03] C:\ProgramData\Favoris
[2006-11-02|15:02] C:\ProgramData\Favorites
[2009-06-09|21:05] C:\ProgramData\HP
[2009-06-09|21:45] C:\ProgramData\HP Product Assistant
[2009-06-09|21:03] C:\ProgramData\HPSSUPPLY
[2009-06-09|21:50] C:\ProgramData\hpzinstall.log
[2009-04-16|17:18] C:\ProgramData\LauncherAccess.dt
[2009-03-30|16:11] C:\ProgramData\ma-config.com
[2009-04-05|13:24] C:\ProgramData\Malwarebytes
[2009-03-05|22:03] C:\ProgramData\Menu Démarrer
[2009-03-18|01:26] C:\ProgramData\MGS
[2009-06-07|15:28] C:\ProgramData\Micro Application
[2009-03-09|22:48] C:\ProgramData\Microsoft
[2009-03-09|22:48] C:\ProgramData\Microsoft Help
[2009-03-05|22:03] C:\ProgramData\Modèles
[2009-08-25|00:52] C:\ProgramData\NexonEU
[2009-08-27|00:16] C:\ProgramData\ntuser.pol
[2009-04-05|21:56] C:\ProgramData\NVIDIA
[2009-08-28|16:35] C:\ProgramData\nvModes.001
[2009-08-28|16:35] C:\ProgramData\nvModes.dat
[2009-03-28|20:22] C:\ProgramData\Sony
[2009-04-07|00:18] C:\ProgramData\Spybot - Search & Destroy
[2009-03-19|18:46] C:\ProgramData\SRS Labs
[2006-11-02|15:02] C:\ProgramData\Start Menu
[2009-03-06|16:47] C:\ProgramData\Symantec
[2009-08-28|15:51] C:\ProgramData\TEMP
[2006-11-02|15:02] C:\ProgramData\Templates
[2009-03-06|16:39] C:\ProgramData\TuneUp Software
[2009-08-14|18:28] C:\ProgramData\Ubisoft

--------------------\\ Listing des dossiers dans C:\Program Files

[2009-03-10|19:10] C:\Program Files\AC3Filter
[2009-03-05|22:20] C:\Program Files\ACER CrystalEye webcam
[2009-03-12|21:11] C:\Program Files\Acer GameZone
[2009-03-11|16:45] C:\Program Files\Acer Inc
[2009-06-06|22:49] C:\Program Files\Adobe
[2009-08-26|23:08] C:\Program Files\Ad-remover
[2009-04-05|21:54] C:\Program Files\AGEIA Technologies
[2009-05-31|02:25] C:\Program Files\Apple Software Update
[2009-03-09|23:52] C:\Program Files\BitDefender
[2009-03-28|22:05] C:\Program Files\Blender Foundation
[2007-12-21|05:58] C:\Program Files\Broadcom
[2009-03-09|22:12] C:\Program Files\CCleaner
[2009-04-06|21:25] C:\Program Files\CDBurnerXP
[2009-07-10|03:58] C:\Program Files\cFosSpeed
[2009-08-23|02:36] C:\Program Files\Cluedo
[2009-08-26|23:52] C:\Program Files\Common Files
[2007-12-21|05:43] C:\Program Files\CONEXANT
[2009-06-05|12:52] C:\Program Files\CV Expert 3
[2009-06-05|11:47] C:\Program Files\CVitae
[2007-12-21|07:19] C:\Program Files\CyberLink
[2009-08-15|19:54] C:\Program Files\DAEMON Tools Lite
[2009-07-15|01:48] C:\Program Files\Deenero
[2009-07-13|02:29] C:\Program Files\DivX
[2009-08-11|02:22] C:\Program Files\DMV
[2009-03-05|22:03] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
[2009-04-06|21:19] C:\Program Files\filehippo.com
[2009-06-23|12:34] C:\Program Files\FileZilla FTP Client
[2009-06-09|21:00] C:\Program Files\Hewlett-Packard
[2009-06-09|21:03] C:\Program Files\HP
[2009-08-22|05:15] C:\Program Files\InstallShield Installation Information
[2009-07-30|03:01] C:\Program Files\Internet Explorer
[2009-04-06|21:35] C:\Program Files\Java
[2009-06-05|13:05] C:\Program Files\JRE
[2009-03-05|22:10] C:\Program Files\Launch Manager
[2009-03-30|16:11] C:\Program Files\ma-config.com
[2009-08-26|12:09] C:\Program Files\Malwarebytes' Anti-Malware
[2009-06-07|15:21] C:\Program Files\Micro Application
[2009-03-08|20:24] C:\Program Files\Microsoft
[2009-03-09|23:29] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[2006-11-02|14:37] C:\Program Files\Microsoft Games
[2009-03-08|02:08] C:\Program Files\Microsoft LifeChat
[2009-06-05|12:36] C:\Program Files\Microsoft Office
[2009-08-03|12:13] C:\Program Files\Microsoft Silverlight
[2009-03-25|14:47] C:\Program Files\Microsoft SQL Server
[2009-08-15|20:28] C:\Program Files\Microsoft WSE
[2009-03-06|19:56] C:\Program Files\Movie Maker
[2009-08-28|16:42] C:\Program Files\Mozilla Firefox
[2006-11-02|14:37] C:\Program Files\MSBuild
[2007-12-21|06:29] C:\Program Files\MSXML 4.0
[2009-03-12|21:11] C:\Program Files\NeoSmart Technologies
[2007-12-21|07:09] C:\Program Files\NewTech Infosystems
[2009-03-12|21:03] C:\Program Files\Notepad++
[2009-06-05|13:05] C:\Program Files\OpenOffice.org 3
[2009-08-23|02:46] C:\Program Files\Petank Party
[2009-04-26|17:38] C:\Program Files\Real Desktop
[2009-03-05|21:59] C:\Program Files\Realtek
[2006-11-02|14:37] C:\Program Files\Reference Assemblies
[2009-03-20|20:18] C:\Program Files\RocketDock
[2009-03-14|19:56] C:\Program Files\Samsung
[2009-08-22|05:15] C:\Program Files\SEGA
[2009-08-23|23:26] C:\Program Files\Sierra
[2009-03-28|20:22] C:\Program Files\Sony
[2009-03-25|14:43] C:\Program Files\Sony Setup
[2009-08-27|22:43] C:\Program Files\Steam
[2009-03-05|22:20] C:\Program Files\SUYIN
[2007-12-21|06:01] C:\Program Files\Synaptics
[2009-04-11|13:34] C:\Program Files\SystemRequirementsLab
[2009-06-18|23:31] C:\Program Files\TeamSpeak 3
[2009-03-09|20:25] C:\Program Files\TeamViewer
[2009-08-25|21:32] C:\Program Files\trend micro
[2009-03-22|20:27] C:\Program Files\TuneUp Utilities 2009
[2009-03-25|14:47] C:\Program Files\Uninstall Information
[2009-06-21|21:45] C:\Program Files\Valve
[2009-03-17|23:13] C:\Program Files\VideoLAN
[2009-03-28|20:23] C:\Program Files\Vstplugins
[2007-12-21|06:04] C:\Program Files\Winbond Electronics
[2009-03-06|19:56] C:\Program Files\Windows Calendar
[2009-03-06|19:56] C:\Program Files\Windows Collaboration
[2009-03-06|19:56] C:\Program Files\Windows Defender
[2009-03-06|19:56] C:\Program Files\Windows Journal
[2009-03-08|20:24] C:\Program Files\Windows Live
[2009-06-05|20:44] C:\Program Files\Windows Live Safety Center
[2009-08-12|15:11] C:\Program Files\Windows Mail
[2009-08-12|15:11] C:\Program Files\Windows Media Player
[2009-03-05|22:03] C:\Program Files\Windows NT
[2009-03-06|19:56] C:\Program Files\Windows Photo Gallery
[2009-03-06|19:56] C:\Program Files\Windows Sidebar
[2009-03-08|02:18] C:\Program Files\WinRAR
[2009-03-20|16:12] C:\Program Files\Yahoo!
[2009-07-15|01:41] C:\Program Files\Zattoo

--------------------\\ Listing des dossiers dans C:\Program Files\Common Files

[2009-06-06|22:49] C:\Program Files\Common Files\Adobe
[2009-03-23|18:38] C:\Program Files\Common Files\Adobe-BackupByPhotoshopPortable
[2009-03-09|23:52] C:\Program Files\Common Files\BitDefender
[2009-06-05|10:16] C:\Program Files\Common Files\Borland Shared
[2009-03-29|00:12] C:\Program Files\Common Files\DivX Shared
[2009-06-09|21:00] C:\Program Files\Common Files\Hewlett-Packard
[2009-06-09|21:03] C:\Program Files\Common Files\HP
[2007-12-21|07:16] C:\Program Files\Common Files\InstallShield
[2007-12-21|07:08] C:\Program Files\Common Files\LightScribe
[2009-08-23|02:46] C:\Program Files\Common Files\microsoft shared
[2007-12-21|07:08] C:\Program Files\Common Files\muvee Technologies
[2007-12-21|07:09] C:\Program Files\Common Files\NewTech Infosystems
[2009-03-29|00:12] C:\Program Files\Common Files\PX Storage Engine
[2006-11-02|13:18] C:\Program Files\Common Files\Services
[2009-03-05|22:18] C:\Program Files\Common Files\snp2uvc
[2006-11-02|13:18] C:\Program Files\Common Files\SpeechEngines
[2009-08-15|01:12] C:\Program Files\Common Files\Steam
[2009-03-06|16:50] C:\Program Files\Common Files\Symantec Shared
[2009-03-06|19:56] C:\Program Files\Common Files\System
[2009-03-08|20:17] C:\Program Files\Common Files\Windows Live
[2009-04-05|21:54] C:\Program Files\Common Files\Wise Installation Wizard

--------------------\\ Process

( 60 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-28 17:00:57
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Recherche d'autres infections

Salut Kalofdu47 !

Lainvi s'étant absenté, il m'a demandé de voir un peu la suite avec toi. Ce n'est pas facile de prendre un sujet en route ! :)

Peux-tu faire ceci stp :

LopSD : Recherche :

▶ Télécharge et enregistre lopSD sur le Bureau

▶ Double-clique sur Lop S&D

▶ Fais l'installation

▶ Ferme toutes les applications

▶ Avec VISTA => clic-droit et => Exécuter en tant qu'administrateur

▶ Tape F pour français , puis presse entrée

▶ Tape 1

▶ Presse Entrée

▶ Le PC va redémarrer

* Note : si l'antivirus annonce une infection dans TEMP , l'ignorer

▶ Attend l'apparition du rapport

▶ Copie le rapport et colle-le dans la réponse

* le rapport se trouve aussi à C:\lopR

++

j'up ce sujet car je n'ai plus de nouvelle de mon helpeur qui ma grandement aider , si quelqu'un pourrait venir vérifier ce que les rapports du dessus on donner ça serai cool

Kalof

voila le Log COMBOfix.txt

ComboFix 09-08-26.05 - RuDy 2009-08-26 23:49.4.2 - NTFSx86
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.3070.2158 [GMT 2:00]
Running from: c:\users\RuDy\Desktop\C-Fix.exe
AV: Antivirus BitDefender *On-access scanning enabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
FW: Pare-feu BitDefender *enabled* {4055920F-2E99-48A8-A270-4243D2B8F242}
SP: BitDefender AntiSpam *disabled* (Updated) {8B2012EC-32D4-494F-BC03-832DB3BDF911}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_BRCBQFRGG
-------\Service_JAXK
-------\Service_KOOZ
-------\Service_NNQ
-------\Service_RNYMCOQLD
-------\Service_ZATTID

((((((((((((((((((((((((( Files Created from 2009-07-26 to 2009-08-26 )))))))))))))))))))))))))))))))
.

2009-08-26 21:56 . 2009-08-26 21:59 -------- d-----w- c:\users\RuDy\AppData\Local\temp
2009-08-26 21:56 . 2009-08-26 21:56 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-08-26 20:53 . 2009-08-26 21:08 -------- d-----w- c:\program files\Ad-remover
2009-08-26 20:15 . 2009-08-26 20:16 -------- d-----w- C:\Kill'em
2009-08-26 17:35 . 2009-06-22 10:22 2048 ----a-w- c:\windows\system32\tzres.dll
2009-08-26 12:31 . 2009-08-26 12:56 -------- d-----w- C:\UsbFix
2009-08-26 12:08 . 2009-08-26 20:37 -------- d-----w- C:\rsit
2009-08-26 10:09 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-26 10:09 . 2009-08-26 10:09 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-26 10:09 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-26 09:41 . 2009-08-26 09:54 -------- d-----w- C:\FindyKill
2009-08-26 08:45 . 2009-06-05 12:34 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-26 08:45 . 2009-06-05 10:08 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-25 19:56 . 2009-08-26 21:19 -------- d-----w- C:\ToolBar SD
2009-08-24 22:48 . 2009-08-24 22:48 81920 ----a-w- c:\programdata\NexonEU\NGM\npNxGameeu.dll
2009-08-24 22:48 . 2009-08-24 22:52 -------- d-----w- c:\programdata\NexonEU
2009-08-24 22:48 . 2009-08-24 22:48 98304 ----a-w- c:\programdata\NexonEU\NGM\nxgameeu.dll
2009-08-24 22:48 . 2009-08-24 22:48 532480 ----a-w- c:\programdata\NexonEU\NGM\NGMDll.dll
2009-08-24 22:48 . 2009-08-24 22:48 331776 ----a-w- c:\programdata\NexonEU\NGM\NGMResource.dll
2009-08-24 22:48 . 2009-08-24 22:48 258352 ----a-w- c:\programdata\NexonEU\NGM\unicows.dll
2009-08-24 22:48 . 2009-08-24 22:48 155648 ----a-w- c:\programdata\NexonEU\NGM\NGM.exe
2009-08-23 22:47 . 2009-08-23 22:47 -------- d-----w- C:\SIERRA
2009-08-23 21:40 . 2009-08-23 21:40 -------- d-----w- C:\jeuxdos
2009-08-23 21:26 . 2009-08-23 21:26 -------- d-----w- c:\program files\Sierra
2009-08-23 00:46 . 2009-08-23 00:46 -------- d-----w- c:\program files\Petank Party
2009-08-23 00:36 . 2009-08-23 00:36 -------- d-----w- c:\users\RuDy\AppData\Roaming\GamesCafe
2009-08-23 00:36 . 2009-08-23 00:36 4096 ----a-w- c:\windows\d3dx.dat
2009-08-23 00:36 . 2009-08-23 00:36 -------- d-----w- c:\program files\Cluedo
2009-08-22 18:45 . 2009-06-15 15:21 499712 ----a-w- c:\windows\system32\kerberos.dll
2009-08-22 18:45 . 2009-06-15 15:24 175104 ----a-w- c:\windows\system32\wdigest.dll
2009-08-22 18:45 . 2009-06-15 15:24 270848 ----a-w- c:\windows\system32\schannel.dll
2009-08-22 18:45 . 2009-06-15 15:23 1256448 ----a-w- c:\windows\system32\lsasrv.dll
2009-08-22 18:45 . 2009-06-15 15:22 213504 ----a-w- c:\windows\system32\msv1_0.dll
2009-08-22 18:45 . 2009-06-15 18:20 439896 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-08-22 18:45 . 2009-06-15 12:57 9728 ----a-w- c:\windows\system32\lsass.exe
2009-08-22 18:45 . 2009-06-15 15:24 72704 ----a-w- c:\windows\system32\secur32.dll
2009-08-22 18:16 . 2009-08-22 18:16 165232 ---ha-w- c:\users\RuDy\AppData\Roaming\Microsoft\Virtual PC\VPCKeyboard.dll
2009-08-22 03:26 . 2009-08-24 20:44 -------- d-----w- c:\users\RuDy\AppData\Local\VirtuaTennis2009
2009-08-22 03:24 . 2008-10-15 04:22 452440 ----a-w- c:\windows\system32\d3dx10_40.dll
2009-08-22 03:24 . 2008-10-15 04:22 2036576 ----a-w- c:\windows\system32\D3DCompiler_40.dll
2009-08-22 03:24 . 2008-10-15 04:22 4379984 ----a-w- c:\windows\system32\D3DX9_40.dll
2009-08-22 03:15 . 2009-08-22 03:15 -------- d-----w- c:\program files\SEGA
2009-08-20 22:30 . 2009-08-20 22:30 -------- d-----w- c:\users\RuDy\AppData\Local\Ph03nixNewMedia
2009-08-20 01:19 . 2009-08-20 01:20 -------- d--h--w- c:\windows\msdownld.tmp
2009-08-17 01:45 . 2009-08-17 01:45 -------- d-----w- c:\users\RuDy\AppData\Roaming\ValuSoft
2009-08-15 18:28 . 2009-08-15 18:28 10134 ----a-r- c:\users\RuDy\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-08-15 18:28 . 2008-09-04 18:17 447752 ----a-w- c:\windows\system32\vp6vfw.dll
2009-08-15 18:28 . 2009-08-15 18:28 -------- d-----w- c:\program files\Microsoft WSE
2009-08-15 17:54 . 2009-08-15 17:54 -------- d-----w- c:\programdata\DAEMON Tools Lite
2009-08-15 17:54 . 2009-08-15 17:54 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-08-15 17:47 . 2009-08-15 20:48 -------- d-----w- c:\users\RuDy\AppData\Roaming\DAEMON Tools Lite
2009-08-14 16:28 . 2009-08-14 16:28 -------- d-----w- c:\programdata\Ubisoft
2009-08-14 16:27 . 2007-10-22 01:39 267272 ----a-w- c:\windows\system32\xactengine2_10.dll
2009-08-14 16:27 . 2007-10-12 13:14 3734536 ----a-w- c:\windows\system32\d3dx9_36.dll
2009-08-14 16:27 . 2007-10-12 13:14 1374232 ----a-w- c:\windows\system32\D3DCompiler_36.dll
2009-08-14 16:27 . 2007-10-02 07:56 444776 ----a-w- c:\windows\system32\d3dx10_36.dll
2009-08-14 16:27 . 2007-07-19 22:57 267112 ----a-w- c:\windows\system32\xactengine2_9.dll
2009-08-14 16:27 . 2007-07-19 16:14 444776 ----a-w- c:\windows\system32\d3dx10_35.dll
2009-08-14 16:27 . 2007-07-19 16:14 3727720 ----a-w- c:\windows\system32\d3dx9_35.dll
2009-08-14 16:27 . 2007-07-19 16:14 1358192 ----a-w- c:\windows\system32\D3DCompiler_35.dll
2009-08-14 16:27 . 2007-10-22 01:37 17928 ----a-w- c:\windows\system32\X3DAudio1_2.dll
2009-08-14 16:27 . 2007-06-20 18:46 266088 ----a-w- c:\windows\system32\xactengine2_8.dll
2009-08-11 18:24 . 2009-07-17 14:35 71680 ----a-w- c:\windows\system32\atl.dll
2009-08-11 18:24 . 2009-06-10 12:12 160256 ----a-w- c:\windows\system32\wkssvc.dll
2009-08-11 18:24 . 2009-06-04 12:34 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-08-11 18:24 . 2009-06-10 12:07 91136 ----a-w- c:\windows\system32\avifil32.dll
2009-08-11 18:24 . 2009-07-14 13:00 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2009-08-11 18:24 . 2009-07-14 12:58 7680 ----a-w- c:\windows\system32\spwmp.dll
2009-08-11 18:24 . 2009-07-14 12:59 4096 ----a-w- c:\windows\system32\dxmasf.dll
2009-08-11 18:24 . 2009-07-14 10:59 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-08-11 00:23 . 2009-08-11 00:23 -------- d-----w- c:\users\RuDy\AppData\Roaming\DMV Technologies
2009-08-11 00:23 . 2009-08-11 00:23 -------- d-----w- c:\users\RuDy\AppData\Local\DMV Technologies
2009-08-11 00:22 . 2009-08-11 00:22 -------- d-----w- c:\windows\MaxTV
2009-08-11 00:22 . 2009-08-11 00:22 -------- d-----w- c:\program files\DMV
2009-08-09 15:08 . 2009-08-09 15:08 -------- d-----w- C:\Download
2009-08-09 15:07 . 2009-08-24 22:48 -------- d-----w- C:\Nexon
2009-08-09 15:07 . 2009-08-09 15:07 421888 ----a-w- c:\windows\NEXON_EU_DownloaderUpdater.exe
2009-08-06 18:41 . 2009-08-06 18:41 -------- d-----w- C:\sound

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-26 21:56 . 2009-03-09 22:01 81984 ----a-w- c:\windows\system32\bdod.bin
2009-08-26 21:25 . 2006-11-02 15:48 690868 ----a-w- c:\windows\system32\perfh00C.dat
2009-08-26 21:25 . 2006-11-02 15:48 134270 ----a-w- c:\windows\system32\perfc00C.dat
2009-08-26 21:18 . 2009-04-05 19:54 31776 ----a-w- c:\programdata\nvModes.dat
2009-08-26 10:21 . 2009-04-10 19:45 -------- d-----w- c:\program files\Steam
2009-08-25 19:32 . 2009-04-05 13:27 -------- d-----w- c:\program files\trend micro
2009-08-23 19:25 . 2009-06-11 19:55 -------- d-----w- c:\users\RuDy\AppData\Roaming\U3
2009-08-22 03:15 . 2007-12-21 04:01 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-21 14:29 . 2009-02-03 16:03 104456 ----a-w- c:\windows\system32\drivers\bdfndisf.sys
2009-08-15 17:48 . 2009-04-03 11:57 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-08-14 23:12 . 2009-04-10 19:45 -------- d-----w- c:\program files\Common Files\Steam
2009-08-14 16:27 . 2009-05-31 17:02 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-08-14 16:27 . 2009-05-31 17:02 22328 ----a-w- c:\users\RuDy\AppData\Roaming\PnkBstrK.sys
2009-08-14 16:27 . 2009-05-31 17:02 22328 ----a-w- c:\users\RuDy\AppData\Roaming\PnkBstrK.sys
2009-08-14 16:27 . 2009-05-31 17:02 107832 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-08-14 16:27 . 2009-05-31 17:02 66872 ----a-w- c:\windows\system32\PnkBstrA.exe
2009-08-14 16:27 . 2009-05-31 17:02 2337865 ----a-w- c:\windows\system32\pbsvc.exe
2009-08-13 18:24 . 2009-04-15 18:23 -------- d-----w- c:\users\RuDy\AppData\Roaming\DMCache
2009-08-12 13:11 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-08-03 10:13 . 2009-05-06 16:38 -------- d-----w- c:\program files\Microsoft Silverlight
2009-07-18 16:06 . 2009-07-29 11:26 827904 ----a-w- c:\windows\system32\wininet.dll
2009-07-18 16:01 . 2009-07-29 11:26 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-07-18 09:46 . 2009-07-29 11:26 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-15 15:23 . 2009-03-05 20:09 75912 ----a-w- c:\users\RuDy\AppData\Local\GDIPFONTCACHEV1.DAT
2009-07-14 23:51 . 2009-07-14 23:49 -------- d-----w- c:\users\RuDy\AppData\Roaming\Python-Eggs
2009-07-14 23:48 . 2009-07-14 23:48 -------- d-----w- c:\program files\Deenero
2009-07-14 23:41 . 2009-03-19 21:53 -------- d-----w- c:\program files\Zattoo
2009-07-14 20:44 . 2009-07-10 00:18 87 ----a-w- c:\users\RuDy\AppData\Local\asmqy.bat
2009-07-13 00:29 . 2009-03-28 22:08 -------- d-----w- c:\program files\DivX
2009-07-12 14:32 . 2009-06-23 10:34 -------- d-----w- c:\users\RuDy\AppData\Roaming\FileZilla
2009-07-10 01:58 . 2009-07-10 01:41 -------- d-----w- c:\program files\cFosSpeed
2009-07-09 14:50 . 2009-07-09 14:47 122 ----a-w- c:\windows\tmp.tmp.tmp
2009-06-15 18:41 . 2009-06-05 11:08 1 ----a-w- c:\users\RuDy\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-06-15 15:24 . 2009-07-15 15:31 156672 ----a-w- c:\windows\system32\t2embed.dll
2009-06-15 15:20 . 2009-07-15 15:31 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-06-15 15:20 . 2009-07-15 15:31 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-06-15 12:52 . 2009-07-15 15:31 289792 ----a-w- c:\windows\system32\atmfd.dll
2009-06-11 14:52 . 2009-07-14 23:49 123904 ----a-w- c:\users\RuDy\AppData\Roaming\Python-Eggs\elisa_plugin_codecs-0.1.101-py2.5.egg-tmp\elisa\plugins\codecs\gstreamer\libgstflumpegdemux.dll
2009-06-11 14:52 . 2009-07-14 23:49 128000 ----a-w- c:\users\RuDy\AppData\Roaming\Python-Eggs\elisa_plugin_codecs-0.1.101-py2.5.egg-tmp\elisa\plugins\codecs\gstreamer\libgstfluasfdemux.dll
2009-06-09 19:50 . 2009-06-09 19:49 119518 ----a-w- c:\windows\hpqins00.dat
2009-06-09 19:04 . 2009-06-09 18:57 164353 ----a-w- c:\windows\hpoins19.dat
2009-06-05 18:41 . 2009-06-05 18:41 53760 ----a-w- c:\users\RuDy\AppData\Roaming\Thinstall\WORD 2007\1000000600002h\verclsid.exe
2009-06-05 18:41 . 2009-06-05 18:41 53760 ----a-w- c:\users\RuDy\AppData\Roaming\Thinstall\WORD 2007\300000005700002h\WINWORD.EXE
2009-06-05 11:06 . 2009-06-05 11:06 7424000 ----a-r- c:\users\RuDy\AppData\Roaming\Microsoft\Installer\{0FA44E79-CD7D-4E8D-A2EE-26FE05F509B6}\soffice.exe
2009-04-06 18:02 . 2008-10-30 16:34 49664 ----a-w- c:\program files\mozilla firefox\components\FFComm.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{66886C4D-B307-4ECA-A228-52CA9B9851A4}"= "c:\program files\Deenero\deenero_1,0,1,4.dll" [2009-07-01 484032]

[HKEY_CLASSES_ROOT\clsid\{66886c4d-b307-4eca-a228-52ca9b9851a4}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-04-06 69632]
"BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-08-21 782336]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-12-14 102400]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-30 13605408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"UacDisableNotify"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Sidebar"=c:\program files\Windows Sidebar\sidebar.exe /autoRun
"WindowsWelcomeCenter"=rundll32.exe oobefldr.dll,ShowWelcomeCenter
"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe
"filehippo.com"="c:\program files\filehippo.com\UpdateChecker.exe" /background
"Steam"="c:\program files\Steam\Steam.exe" -silent
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" -autorun

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"LManager"=c:\progra~1\LAUNCH~1\QtZgAcer.EXE
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"WarReg_PopUp"=c:\acer\WR_PopUp\WarReg_PopUp.exe
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"eDataSecurity Loader"=c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{AEAE4C8A-FFF1-4985-8302-8CEA7B757B6A}"= c:\program files\Acer\Acer VCM\VC.exe:Acer VCM
"{9F32C73A-2D16-4E13-A4AC-0D05AA29A9D2}"= UDP:4661:port
"TCP Query User{420D1477-8DB5-4044-90F2-A19DC5E10FF0}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{9678EF5E-FFA4-49BC-8610-EC5F7054E732}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{CBB2D9ED-6D1A-4829-BEA1-CCC2BE493953}c:\\program files\\teamviewer\\version4\\teamviewer.exe"= UDP:c:\program files\teamviewer\version4\teamviewer.exe:TeamViewer Remote Control Application
"UDP Query User{14E4BDED-62A8-4E72-A1C1-87DF559856CE}c:\\program files\\teamviewer\\version4\\teamviewer.exe"= TCP:c:\program files\teamviewer\version4\teamviewer.exe:TeamViewer Remote Control Application
"TCP Query User{0FE697BD-0EFF-421A-BC75-B8A342CD51EE}c:\\program files\\zattoo\\zattood.exe"= UDP:c:\program files\zattoo\zattood.exe:zattood
"UDP Query User{B7E847EC-E629-48B7-8309-8B71F6D666BB}c:\\program files\\zattoo\\zattood.exe"= TCP:c:\program files\zattoo\zattood.exe:zattood
"TCP Query User{47487EA0-06BD-418A-908E-F96072B4A697}c:\\program files\\zattoo\\zattoo.exe"= UDP:c:\program files\zattoo\zattoo.exe:
"UDP Query User{769DAED8-0A63-430F-99AE-F7130A1C71CD}c:\\program files\\zattoo\\zattoo.exe"= TCP:c:\program files\zattoo\zattoo.exe:
"{6EE13C76-7B6F-4C8A-9C70-5AD3B716184D}"= UDP:48113:LocalSubnet:LocalSubnet:maconfig_tcp
"{383247A1-715A-487C-9EEE-68689843CE27}"= TCP:48113:LocalSubnet:LocalSubnet:maconfig_udp
"{E058F5E4-FB8D-4FD4-A898-004F8D0AA5CC}"= UDP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"{222318F5-4EC9-4766-ABAD-2323ABC6752D}"= TCP:c:\program files\ma-config.com\maconfservice.exe:maconfservice
"TCP Query User{A704C760-6CF7-460F-B515-0E42F4B8D8F1}c:\\program files\\java\\jre6\\bin\\java.exe"= UDP:c:\program files\java\jre6\bin\java.exe:Java(TM) Platform SE binary
"UDP Query User{767DF03D-65A2-4119-863D-D592A52A1F52}c:\\program files\\java\\jre6\\bin\\java.exe"= TCP:c:\program files\java\jre6\bin\java.exe:Java(TM) Platform SE binary
"TCP Query User{5C95AAE8-5965-4D4D-8BAB-57EF785A8747}c:\\program files\\steam\\steamapps\\darkangel965\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\darkangel965\counter-strike source\hl2.exe:hl2
"UDP Query User{CFDAAAF3-E7FD-4FB4-A474-C62F7E38F68A}c:\\program files\\steam\\steamapps\\darkangel965\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\darkangel965\counter-strike source\hl2.exe:hl2
"{4247B3B7-4161-4DA3-A1AC-095F97C0CA9C}"= UDP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{C82C3ECF-E846-4CBF-A4D0-0CA6C1EAD771}"= TCP:c:\windows\System32\PnkBstrA.exe:PnkBstrA
"{47DAB0E2-7743-4DE1-9207-DBB26615E4DF}"= UDP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"{8A250227-36F2-496B-BE60-84CBD92A6FB8}"= TCP:c:\windows\System32\PnkBstrB.exe:PnkBstrB
"TCP Query User{A0B1E56B-4716-448A-8F1D-EFA9EC9EA72D}c:\\program files\\steam\\steamapps\\darkangel965\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\darkangel965\counter-strike source\hl2.exe:hl2
"UDP Query User{7EA34D7C-F536-464A-ABFE-B38939E032A8}c:\\program files\\steam\\steamapps\\darkangel965\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\darkangel965\counter-strike source\hl2.exe:hl2
"TCP Query User{FE24DF1A-BBD4-43F6-BA58-9735023FD5F1}c:\\program files\\java\\jre6\\bin\\java.exe"= UDP:c:\program files\java\jre6\bin\java.exe:Java(TM) Platform SE binary
"UDP Query User{FB7C1628-4C2A-4997-BB9B-6FC57A9A163F}c:\\program files\\java\\jre6\\bin\\java.exe"= TCP:c:\program files\java\jre6\bin\java.exe:Java(TM) Platform SE binary
"{FA20A470-F6FA-4361-921D-B4F9BFF722A5}"= UDP:c:\program files\Steam\steamapps\common\call of duty 4\iw3sp.exe:Call of Duty 4: Modern Warfare
"{F742F20F-A4B3-457B-8399-71008218CBF6}"= TCP:c:\program files\Steam\steamapps\common\call of duty 4\iw3sp.exe:Call of Duty 4: Modern Warfare
"{B6D3D1E7-FB3E-44DD-8275-25C36EC8E6AF}"= UDP:c:\program files\Steam\steamapps\common\call of duty 4\iw3mp.exe:Call of Duty 4: Modern Warfare
"{DE2DB93A-6A19-46F3-A02F-F9F551ACE417}"= TCP:c:\program files\Steam\steamapps\common\call of duty 4\iw3mp.exe:Call of Duty 4: Modern Warfare
"TCP Query User{3AFCBDC4-A324-48D4-A1EE-44C4A09A9F4A}c:\\nexon\\nexon_eu_downloader\\nexon_eu_downloader_engine.exe"= UDP:c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe:NEXON_EU_Downloader_Engine
"UDP Query User{1AB8A302-21DA-4059-AF20-A3B6CC376227}c:\\nexon\\nexon_eu_downloader\\nexon_eu_downloader_engine.exe"= TCP:c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe:NEXON_EU_Downloader_Engine
"TCP Query User{A2BC10B5-96C5-4B9A-A830-46BCD419AB21}c:\\program files\\dmv\\maxtv4\\maxtv.exe"= UDP:c:\program files\dmv\maxtv4\maxtv.exe:maxtv
"UDP Query User{EF58F0CD-E8A5-4788-9F8B-BED9EFD084B1}c:\\program files\\dmv\\maxtv4\\maxtv.exe"= TCP:c:\program files\dmv\maxtv4\maxtv.exe:maxtv
"TCP Query User{7EE2A314-5813-46C5-86C6-A29E19778675}c:\\users\\rudy\\desktop\\left 4 dead\\left 4 dead\\left4dead.exe"= UDP:c:\users\rudy\desktop\left 4 dead\left 4 dead\left4dead.exe:left4dead.exe
"UDP Query User{126E7399-A413-44BE-B594-AA0D04CBCF1E}c:\\users\\rudy\\desktop\\left 4 dead\\left 4 dead\\left4dead.exe"= TCP:c:\users\rudy\desktop\left 4 dead\left 4 dead\left4dead.exe:left4dead.exe
"TCP Query User{DD8B496B-6821-49D1-9B7C-A690D70824D2}c:\\windows\\system32\\dplaysvr.exe"= UDP:c:\windows\system32\dplaysvr.exe:Application d'assistance Microsoft DirectPlay
"UDP Query User{4017453F-0A31-465D-9FFC-8F9469C96FD8}c:\\windows\\system32\\dplaysvr.exe"= TCP:c:\windows\system32\dplaysvr.exe:Application d'assistance Microsoft DirectPlay
"TCP Query User{7E6153A9-A08D-4870-9643-CA06A5328B10}c:\\users\\rudy\\desktop\\volley\\volley\\volley.exe"= UDP:c:\users\rudy\desktop\volley\volley\volley.exe:volley.exe
"UDP Query User{F6C4BD58-D359-4EB9-9E56-32A9810AC285}c:\\users\\rudy\\desktop\\volley\\volley\\volley.exe"= TCP:c:\users\rudy\desktop\volley\volley\volley.exe:volley.exe
"{87975934-9B36-4152-B1C8-BD8BD6B829AC}"= UDP:c:\programdata\NexonEU\NGM\NGM.exe:Nexon Game Manager
"{F8B3736C-4EE6-4482-A5E2-F84E1B9210CE}"= TCP:c:\programdata\NexonEU\NGM\NGM.exe:Nexon Game Manager
"{2C4A275A-5D8C-4EED-8304-3A45CDDF4EE4}"= UDP:c:\nexon\Combat Arms EU\NMService.exe:Nexon Messenger Core
"{E22EC8F3-39AF-4831-80AE-52D98645DF5B}"= TCP:c:\nexon\Combat Arms EU\NMService.exe:Nexon Messenger Core

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Nexon\\Combat Arms EU\\CombatArms.exe"= c:\nexon\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe
"c:\\Nexon\\Combat Arms EU\\Engine.exe"= c:\nexon\Combat Arms EU\Engine.exe:*Enabled:Engine.exe

R2 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [2008-07-17 118784]
R2 BDVEDISK;BDVEDISK;c:\program files\BitDefender\BitDefender 2009\BDVEDISK.sys [2008-10-06 82696]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [2007-12-21 179712]
R3 bdfm;BDFM;c:\windows\System32\drivers\bdfm.sys [2008-09-18 111112]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\System32\drivers\bdfndisf.sys [2009-02-03 104456]
R3 winbondcir;Winbond IR Transceiver;c:\windows\System32\drivers\winbondcir.sys [2007-12-21 43008]
S3 A310;AVerMedia A310 DVB-T;c:\windows\System32\drivers\AVerA310USB.sys [2007-12-21 26368]
S3 BDASwCap;AVerMedia A310 BDA DVBT Capture Device;c:\windows\System32\drivers\AVerA310Cap.sys [2007-12-21 42240]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [2009-03-15 216232]
S4 TeamViewer4;TeamViewer 4;c:\program files\TeamViewer\Version4\TeamViewer_Service.exe [2009-02-27 185640]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2009-08-26 c:\windows\Tasks\Maintenance en 1 clic.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-11-21 11:14]

2009-08-26 c:\windows\Tasks\User_Feed_Synchronization-{D7AC5AE7-FBC9-4B52-94A2-5FBF7C03F9A3}.job
- c:\windows\system32\msfeedssync.exe [2009-03-06 22:33]
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{00000000-EED4-02DF-5CEB-60757F723501} - (no file)
WebBrowser-{0000041C-0000-0000-B0EE-10041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-B8E9-6B041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-18EB-6B041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-40EC-57041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-04EC-360F1C040000} - (no file)
WebBrowser-{0000041C-0000-0000-A0F0-2F041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-F0ED-41041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-D4EB-CB0C1C040000} - (no file)
WebBrowser-{0000041C-0000-0000-9CEF-D9041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-3CEE-3F041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-ECEB-C6041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-20EF-530D1C040000} - (no file)
WebBrowser-{0000041C-0000-0000-88E9-B8041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-74EC-B1041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-04EF-B5041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-BCEA-1B041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-04F0-D0041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-88E9-CB041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-3CEF-A2041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-04EA-560D1C040000} - (no file)
WebBrowser-{0000041C-0000-0000-04ED-8F161C040000} - (no file)
WebBrowser-{0000041C-0000-0000-84F0-56151C040000} - (no file)
WebBrowser-{0000041C-0000-0000-80E9-9A041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-ACED-43041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-14EE-37041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-6CED-8E121C040000} - (no file)
WebBrowser-{0000041C-0000-0000-90EE-1C041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-48ED-C1041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-28EC-D5041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-00EC-23041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-08EF-060D1C040000} - (no file)
WebBrowser-{0000041C-0000-0000-44EB-520E1C040000} - (no file)
WebBrowser-{0000041C-0000-0000-90EB-C6041C040000} - (no file)
WebBrowser-{0000041C-0000-0000-84E9-FF031C040000} - (no file)
WebBrowser-{0000041C-0000-0000-08EC-46041C040000} - (no file)
WebBrowser-{755744FB-0000-0000-E4EE-B8038CEFB803} - (no file)
WebBrowser-{122E32F0-FFFE-FFFF-ABF7-767517087775} - (no file)
WebBrowser-{F39375ED-0258-0018-38BD-C50200000000} - (no file)

.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uSearchURL,(Default) = hxxp://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
FF - ProfilePath - c:\users\RuDy\AppData\Roaming\Mozilla\Firefox\Profiles\o0cma8cp.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2046620&SearchSource=3&q=
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2046620&SearchSource=2&q=
FF - component: c:\program files\Mozilla Firefox\components\FFComm.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
FF - plugin: c:\programdata\NexonEU\NGM\npNxGameeu.dll

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-26 23:59
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\nvvsvc.exe
c:\program files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
c:\program files\BitDefender\BitDefender 2009\vsserv.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\rundll32.exe
c:\windows\System32\dllhost.exe
c:\acer\Empowering Technology\eDataSecurity\eDSService.exe
c:\acer\Empowering Technology\eLock\Service\eLockServ.exe
c:\acer\Empowering Technology\eNet\eNet Service.exe
c:\acer\Mobility Center\MobilityService.exe
c:\program files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\System32\PnkBstrA.exe
c:\windows\System32\PnkBstrB.exe
c:\windows\System32\drivers\XAudio.exe
c:\acer\Empowering Technology\eSettings\Service\capuserv.exe
c:\program files\Synaptics\SynTP\SynTPEnh.exe
c:\program files\BitDefender\BitDefender 2009\seccenter.exe
c:\windows\System32\msiexec.exe
c:\windows\System32\wbem\WMIADAP.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2009-08-26 0:05 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-26 22:05
ComboFix2.txt 2009-04-06 10:10
ComboFix3.txt 2009-04-05 15:31

Pre-Run: 111,820,013,568 octets libres
Post-Run: 111,394,729,984 octets libres

372 --- E O F --- 2009-08-26 17:36

bonne nuit et merci , a demain ;)

Salut , il est tard mais je te post le rapport de Toolbar S&D qui n'a toujours pas finalisé , je ne pense pas que cela t aidera d'avantage

-----------\\ ToolBar S&D 1.2.9 XP/Vista

Microsoft® Windows Vista™ Édition Familiale Premium ( v6.0.6001 ) Service Pack 1
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU T5550 @ 1.83GHz )
BIOS : ZD1 v1.3809 3H09
USER : RuDy ( Administrator )
BOOT : Normal boot
Antivirus : Antivirus BitDefender 12.0 (Activated)
Firewall : Pare-feu BitDefender 12.0 (Activated)
C:\ (Local Disk) - NTFS - Total:219 Go (Free:104 Go)
D:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 22-08-2009|18:42 )
Option : [1] ( 2009-08-26|23:19 )

[ UAC => 0 ]

-----------\\ Recherche de Fichiers / Dossiers ...

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"SEARCH PAGE"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Local Page"="C:\\Windows\\system32\\blank.htm"
"SearchMigratedDefaultURL"="https://search.yahoo.com/web{searchTerms}&ei=utf-8&fr=b1ie7"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Default_search_url"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Default_page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Search bar"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Url"="https://www.msn.com/fr-fr/actualite/"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"="https://www.msn.com/fr-fr"
"Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search bar"="http://www.bing.com/spresults.aspx"

--------------------\\ Recherche d'autres infections

on verra demain pour la suite, postes le rapport tout de même ;)

Bonne nuit !

Ok , concernant le crack , je l'ai supprimé ( logiciel pour création de CV :/ ) que j'ai DL sur une plateforme megaupload (crack inclu dans le .exe !)

pour Toolbar s&d , toujours ce même message d'erreur :/

que faire?!!

un grand merci pour toute l'aide que tu as pu aujourd'hui hui m'apportai

Kalof

Rapport Ad-Remover

.
======= RAPPORT D'AD-REMOVER 1.1.4.5_Q | UNIQUEMENT XP/VISTA/SEVEN =======
.
Mit à jour par C_XX le 26/08/2009 à 6:37 PM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 22:54:22, 2009-08-26 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-remover\
Système d'exploitation: Microsoft® Windows Vista™ v6.0.6001
Nom du PC: PC-DE-RUDY | Utilisateur actuel: RuDy
.
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.
.
HKCU\Software\EoRezo
.

(!) -- Fichiers temporaires supprimés.

.
============== Scan additionnel ==============
.
.
* Mozilla FireFox Version 3.0.13 *
.
Nom du profil: o0cma8cp.default (RuDy)
.
(Prefs.js) user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2046620&SearchSource=3&q=");
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.0.13");
(Invalidprefs.js) user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2046620&SearchSource=3&q=");
(Invalidprefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.0.7");
(Invalidprefs.js) user_pref("webdeveloper.r\user_pref("browser.startup.homepage", "hxxp://y.lo.st");
.
(Invalidprefs.js) EFFACÉ: user_pref("webdeveloper.r\user_pref("browser.startup.homepage", "hxxp://y.lo.st");
.
.
* Internet Explorer Version 7.0.6001.18000 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs : res://ieframe.dll/tabswelcome.htm
.
.
============== Processus Cachés/Bloqués de l'API Windows ==============
.
[PID: 1064 ] - 'livesrv.exe'
[PID: 1088 ] - 'vsserv.exe'
[PID: 1380 ] - 'audiodg.exe'
[PID: 1012 ] - 'bdagent.exe'
[PID: 3564 ] - 'seccenter.exe'
.
.
============== Suspect (Cracks, Serials ... ) ==============
.
C:\Users\RuDy\Desktop\Mes fichiers re‡us\PERSO\CVitae 3.1.1+Patch.rar
.
.
===================================
.
2775 Octet(s) - C:\Ad-Report-CLEAN.log
.
2 Fichier(s) - C:\Users\RuDy\AppData\Local\Temp
1 Fichier(s) - C:\Windows\Temp
.
22 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
0 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE
.
Fin à: 23:08:13 | 2009-08-26
.
============== E.O.F ==============
.

voila le second info.txt

info.txt logfile of random's system information tool 1.06 2009-08-26 22:37:58

======Uninstall list======

-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->MsiExec /X{8AAB4176-A747-493A-A42C-B63CFADFD8E3}
32 Bit HP CIO Components Installer-->MsiExec.exe /I{2614F54E-A828-49FA-93BA-45A3F756BFAA}
AC3Filter (remove only)-->C:\Program Files\AC3Filter\uninstall.exe
Acer Crystal Eye webcam-->C:\Program Files\InstallShield Installation Information\{399C37FB-08AF-493B-BFED-20FBD85EDF7F}\setup.exe -runfromtemp -l0x040c -removeonly -u
Acer Crystal Eye webcam-->C:\Program Files\InstallShield Installation Information\{AA047D7C-5E7C-4878-B75C-77589151B563}\setup.exe -runfromtemp -l0x0009 -removeonly
Acer eDataSecurity Management-->C:\Acer\Empowering Technology\eDataSecurity\eDSnstHelper.exe -Operation UNINSTALL
Acer eLock Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{116FF17B-1A30-4FC2-9B01-5BC5BD46B0B3}\setup.exe" -l0x40c -removeonly
Acer Empowering Technology-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AB6097D9-D722-4987-BD9E-A076E2848EE2}\setup.exe" -l0x40c -removeonly
Acer eNet Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C06554A1-2C1E-4D20-B613-EE62C79927CC}\setup.exe" -l0x40c -removeonly
Acer ePresentation Management-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BF839132-BD43-4056-ACBF-4377F4A88E2A}\setup.exe" -l0x40c -removeonly
Acer eSettings Management-->"C:\Program Files\InstallShield Installation Information\{CE65A9A0-9686-45C6-9098-3C9543A412F0}\setup.exe" -runfromtemp -l0x040c -removeonly
Acer Mobility Center Plug-In-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{11316260-6666-467B-AC34-183FCB5D4335}\setup.exe" -l0x40c -removeonly
Acer ScreenSaver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}\setup.exe" -l0x9 -removeonly
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1.2 - Français-->MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A91000000001}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
BitDefender Internet Security 2009-->MsiExec.exe /X{C85FDDDE-B087-48FB-B0B2-52ABB465C304}
Broadcom Gigabit Integrated Controller-->MsiExec.exe /X{D3B3B9B2-FE73-44CB-8C0A-F737D92F991B}
Call of Duty 4: Modern Warfare-->"C:\Program Files\Steam\steam.exe" steam://uninstall/7940
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
CDBurnerXP-->"C:\Program Files\CDBurnerXP\unins000.exe"
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Combat Arms EU-->"C:\ProgramData\NexonEU\NGM\NGM.exe" -mode:uninstall -dll:ngm.nexoneu.com/cbangm/NGM/Bin/NGMDll.dll -game:50340359 -locale:EU
Counter-Strike: Source-->"C:\Program Files\Steam\steam.exe" steam://uninstall/240
CV et Lettres de Motivation - 9078-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\1050\INTEL3~1\IDriver.exe /M{86764E89-55E0-4C0B-860B-4DC051743B30}
CVitae 3.1.1-->"C:\Program Files\CVitae\uninstall.exe"
DAEMON Tools Toolbar-->C:\Program Files\DAEMON Tools Toolbar\uninst.exe
Deenero-->"C:\Program Files\Deenero\deenerosvr_1,0,1,4.exe" -ShowLightboxPage=uninstall
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Plus DirectShow Filters-->C:\Program Files\DivX\DivXDSFiltersUninstall.exe /DSFILTERS
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Favorit-->c:\users\rudy\appdata\local\asmqy.bat
filehippo.com Update Checker-->"C:\Program Files\filehippo.com\uninstall.exe"
FileZilla Client 3.2.5-->C:\Program Files\FileZilla FTP Client\uninstall.exe
FindyKill-->C:\FindyKill\Uninstal.exe
Half-Life Dedicated Server Update Tool-->C:\PROGRA~1\Valve\HLServer\UNWISE.EXE C:\PROGRA~1\Valve\HLServer\INSTALL.LOG
HDAUDIO Soft Data Fax Modem with SmartCP-->C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFAOR2C06_118\UIU32m.exe -U -IAcrZUn32z.inf
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
HP Customer Participation Program 8.0-->C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
HP Imaging Device Functions 8.0-->C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
HP OCR Software 8.0-->C:\Program Files\HP\Digital Imaging\OCR\hpzscr01.exe -datfile hpqbud11.dat
HP Photosmart Essential-->MsiExec.exe /X{EB21A812-671B-4D08-B974-2A347F0D8F70}
HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B-->C:\Program Files\HP\Digital Imaging\{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}\setup\hpzscr01.exe -datfile hposcr19.dat -onestop -showdisconnect -forcereboot
HP Product Assistant-->MsiExec.exe /I{36FDBE6E-6684-462B-AE98-9A39A1B200CC}
HP Solution Center 8.0-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
HP Update-->MsiExec.exe /X{FE57DE70-95DE-4B64-9266-84DA811053DB}
HPSSupply-->MsiExec.exe /X{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}
Installation Windows Live-->C:\Program Files\Windows Live\Installer\wlarp.exe
Installation Windows Live-->MsiExec.exe /I{7370DF47-B4F9-4279-BFC3-3F09919F720D}
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
Launch Manager-->C:\Windows\UnInst32.exe QtZgAcer.UNI
Les Sims™ 3-->"C:\Program Files\InstallShield Installation Information\{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}\Sims3Setup.exe" -runfromtemp -l0x040c -removeonly
Ma-Config.com-->MsiExec.exe /X{560BD6E0-0BA6-43AF-B423-E1DF4D2EB3C3}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
MaxTV-->"C:\Windows\MaxTV\uninstall_maxtv.exe" "/U:C:\Program Files\DMV\MaxTV4\Uninstall\MaxTV\uninstall_maxtv.xml"
Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
Microsoft .NET Framework 3.5 SP1-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft LifeChat-->MsiExec.exe /X{66039B36-96AE-40D1-8A32-071F7A61B738}
Microsoft Office Word Viewer 2003-->MsiExec.exe /I{9085040C-6000-11D3-8CFE-0150048383C9}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR)-->MsiExec.exe /X{E09B48B5-E141-427A-AB0C-D3605127224A}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft WSE 3.0 Runtime-->MsiExec.exe /X{E3E71D07-CD27-46CB-8448-16D4FB29AA13}
Microsoft XNA Framework Redistributable 2.0-->MsiExec.exe /I{245F6C7A-0C22-4DE0-8202-2AAA620A1D3A}
Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
Mozilla Firefox (3.0.13)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
NTI Backup NOW! 4.7-->"C:\Program Files\InstallShield Installation Information\{67ADE9AF-5CD9-4089-8825-55DE4B366799}\setup.exe" -removeonly
NTI CD & DVD-Maker-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2} /l1036 CDM7
NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI
NVIDIA PhysX-->MsiExec.exe /X{8AAB4176-A747-493A-A42C-B63CFADFD8E3}
OpenOffice.org 3.1-->MsiExec.exe /I{0FA44E79-CD7D-4E8D-A2EE-26FE05F509B6}
Petank Party 1.0.0-->"C:\Program Files\Petank Party\unins000.exe"
Phantasmagoria 2-->MsiExec.exe /I{46569CD0-7378-48EC-BE10-AAFFEFEA82BC}
PowerProducer 3.72-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\Setup.exe" -uninstall
PunkBuster Services-->C:\Windows\system32\pbsvc.exe -u
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.52.02-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{59F6A514-9813-47A3-948C-8A155460CC2A}\Setup.exe" -l0x40c anything
RocketDock 1.3.5-->"C:\Program Files\RocketDock\unins000.exe"
SAMSUNG Mobile Modem Driver Set-->C:\Windows\system32\Samsung_USB_Drivers\3\SSCDUninstall.exe
Samsung Mobile phone USB driver Software-->C:\Windows\system32\Samsung_USB_Drivers\5\SSSDUninstall.exe
SAMSUNG Mobile USB Modem 1.0 Software-->C:\Windows\system32\Samsung_USB_Drivers\1\SS_Uninstall.exe
SAMSUNG Mobile USB Modem Software-->C:\Windows\system32\Samsung_USB_Drivers\2\SSM_Uninstall.exe
Samsung PC Studio 3 USB Driver Installer-->"C:\Program Files\InstallShield Installation Information\{EBA29752-DDD2-4B62-B2E3-9841F92A3E3A}\setup.exe" -runfromtemp -l0x040c -removeonly
Samsung PC Studio 3-->"C:\Program Files\InstallShield Installation Information\{C4A4722E-79F9-417C-BD72-8D359A090C97}\setup.exe" -runfromtemp -l0x040c -removeonly
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Sony Media Manager 2.2-->MsiExec.exe /X{38E1CA6C-2121-4B5C-A3A5-0B0003794EFF}
Sony Vegas 7.0-->MsiExec.exe /X{8411FA28-D32D-4518-92F0-3FBD80A702BC}
Source SDK-->"C:\Program Files\Steam\steam.exe" steam://uninstall/211
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
System Requirements Lab-->C:\Program Files\SystemRequirementsLab\Uninstall.exe
TeamSpeak 3-->C:\Program Files\TeamSpeak 3\uninstall.exe
TeamViewer 4-->C:\Program Files\TeamViewer\Version4\uninstall.exe
TuneUp Utilities 2009-->MsiExec.exe /I{55A29068-F2CE-456C-9148-C869879E2357}
UsbFix-->C:\UsbFix\Uninstal.exe
VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
Virtua Tennis(TM) 2009-->"C:\Program Files\InstallShield Installation Information\{9B63540D-D942-4C38-B42E-A48AE0145970}\setup.exe" -runfromtemp -l0x040c -removeonly
VLC media player 0.9.9-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Winbond CIR Drivers-->MsiExec.exe /X{427967BF-09F8-46D5-9275-37001CCBBA5D}
Windows Live Call-->MsiExec.exe /I{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Messenger-->MsiExec.exe /X{059C042E-796A-4ACC-A81A-ECC2010BB78C}
Windows Live OneCare safety scanner-->"C:\Program Files\Windows Live Safety Center\UnInstall.exe"
Windows Live OneCare safety scanner-->MsiExec.exe /X{FE0646A7-19D0-41B4-A2BB-2C35D644270D}
Zombie Panic! Source Dedicated Server-->"C:\Program Files\Steam\steam.exe" steam://uninstall/17505
Zuma Deluxe-->"C:\Program Files\Acer GameZone\Zuma Deluxe\Uninstall.exe" "C:\Program Files\Acer GameZone\Zuma Deluxe\install.log"

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======Security center information======

AV: Antivirus BitDefender
FW: Pare-feu BitDefender
AS: BitDefender AntiSpam (disabled)
AS: Windows Defender

======System event log======

Computer Name: PC-de-RuDy
Event Code: 4
Message: Broadcom NetLink (TM) Gigabit Ethernet: The network link is down. Check to make sure the network cable is properly connected.
Record Number: 166005
Source Name: b57nd60x
Time Written: 20090715152133.376121-000
Event Type: Avertissement
User:

Computer Name: PC-de-RuDy
Event Code: 4
Message: Broadcom NetLink (TM) Gigabit Ethernet: The network link is down. Check to make sure the network cable is properly connected.
Record Number: 166007
Source Name: b57nd60x
Time Written: 20090716010356.256101-000
Event Type: Avertissement
User:

Computer Name: PC-de-RuDy
Event Code: 4
Message: Broadcom NetLink (TM) Gigabit Ethernet: The network link is down. Check to make sure the network cable is properly connected.
Record Number: 166009
Source Name: b57nd60x
Time Written: 20090716142444.018912-000
Event Type: Avertissement
User:

Computer Name: PC-de-RuDy
Event Code: 4
Message: Broadcom NetLink (TM) Gigabit Ethernet: The network link is down. Check to make sure the network cable is properly connected.
Record Number: 166011
Source Name: b57nd60x
Time Written: 20090717122301.424514-000
Event Type: Avertissement
User:

Computer Name: PC-de-RuDy
Event Code: 4
Message: Broadcom NetLink (TM) Gigabit Ethernet: The network link is down. Check to make sure the network cable is properly connected.
Record Number: 166013
Source Name: b57nd60x
Time Written: 20090718092458.488508-000
Event Type: Avertissement
User:

=====Application event log=====

Computer Name: PC-de-RuDy
Event Code: 1000
Message: Application défaillante findstr.exe, version 6.0.6001.18000, horodatage 0x47918ac0, module défaillant findstr.exe, version 6.0.6001.18000, horodatage 0x47918ac0, code d’exception 0xc0000005, décalage d’erreur 0x0000465d, ID du processus 0xeac, heure de début de l’application 0x01ca26574da4826f.
Record Number: 50316
Source Name: Application Error
Time Written: 20090826141650.000000-000
Event Type: Erreur
User:

Computer Name: PC-de-RuDy
Event Code: 1000
Message: Application défaillante findstr.exe, version 6.0.6001.18000, horodatage 0x47918ac0, module défaillant findstr.exe, version 6.0.6001.18000, horodatage 0x47918ac0, code d’exception 0xc0000005, décalage d’erreur 0x0000465d, ID du processus 0xfbc, heure de début de l’application 0x01ca2657de264c97.
Record Number: 50318
Source Name: Application Error
Time Written: 20090826142045.000000-000
Event Type: Erreur
User:

Computer Name: PC-de-RuDy
Event Code: 1000
Message: Application défaillante findstr.exe, version 6.0.6001.18000, horodatage 0x47918ac0, module défaillant findstr.exe, version 6.0.6001.18000, horodatage 0x47918ac0, code d’exception 0xc0000005, décalage d’erreur 0x0000465d, ID du processus 0x890, heure de début de l’application 0x01ca26586984626f.
Record Number: 50320
Source Name: Application Error
Time Written: 20090826142432.000000-000
Event Type: Erreur
User:

Computer Name: PC-de-RuDy
Event Code: 1000
Message: Application défaillante findstr.exe, version 6.0.6001.18000, horodatage 0x47918ac0, module défaillant findstr.exe, version 6.0.6001.18000, horodatage 0x47918ac0, code d’exception 0xc0000005, décalage d’erreur 0x0000465d, ID du processus 0xd08, heure de début de l’application 0x01ca2658f124d7ef.
Record Number: 50322
Source Name: Application Error
Time Written: 20090826142821.000000-000
Event Type: Erreur
User:

Computer Name: PC-de-RuDy
Event Code: 19011
Message:
Record Number: 50348
Source Name: MSSQL$SONY_MEDIAMGR
Time Written: 20090826173852.000000-000
Event Type: Avertissement
User:

=====Security event log=====

Computer Name: PC-de-RuDy
Event Code: 4672
Message: Privilèges spéciaux attribués à la nouvelle ouverture de session.

Sujet :
ID de sécurité : S-1-5-18
Nom du compte : SYSTEM
Domaine du compte : AUTORITE NT
ID d’ouverture de session : 0x3e7

Privilèges : SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
Record Number: 21048
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090819120557.464061-000
Event Type: Succès de l'audit
User:

Computer Name: PC-de-RuDy
Event Code: 4904
Message: Une tentative d’inscription de la source d’un événement de sécurité a été effectuée.

Sujet :
ID de sécurité : S-1-5-18
Nom du compte : PC-DE-RUDY$
Domaine du compte : WORKGROUP
ID d’ouverture de session : 0x3e7

Processus :
ID du processus : 0x2e0
Nom du processus : C:\Windows\System32\VSSVC.exe

Source de l’événement :
Nom de la source : VSSAudit
ID de la source de l’événement : 0x42f7e9
Record Number: 21049
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090819120753.184861-000
Event Type: Succès de l'audit
User:

Computer Name: PC-de-RuDy
Event Code: 4905
Message: Une tentative d’annulation d’inscription de la source d’un événement de sécurité a été effectuée.

Sujet :
ID de sécurité : S-1-5-18
Nom du compte : PC-DE-RUDY$
Domaine du compte : WORKGROUP
ID d’ouverture de session : 0x3e7

Processus :
ID du processus : 0x2e0
Nom du processus : C:\Windows\System32\VSSVC.exe

Source de l’événement :
Nom de la source : VSSAudit
ID de la source de l’événement : 0x42f7e9
Record Number: 21050
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090819120753.184861-000
Event Type: Succès de l'audit
User:

Computer Name: PC-de-RuDy
Event Code: 5032
Message: Le Pare-feu Windows n’a pas pu notifier l’utilisateur qu’il a empêché une application d’accepter des connexions entrantes sur le réseau.

Code d’erreur : 2
Record Number: 21051
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090819145041.031261-000
Event Type: Échec de l'audit
User:

Computer Name: PC-de-RuDy
Event Code: 5032
Message: Le Pare-feu Windows n’a pas pu notifier l’utilisateur qu’il a empêché une application d’accepter des connexions entrantes sur le réseau.

Code d’erreur : 2
Record Number: 21052
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090819145043.090461-000
Event Type: Échec de l'audit
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=C:\Windows\system32;C:\Windows;C:\Windows\system32\wbem;C:\Program Files\Samsung\Samsung PC Studio 3;C:\Program Files\Microsoft SQL Server\80\Tools\Binn;C:\Program Files\Common Files\DivX Shared;C:\PROGRA~1\DISKEE~1\DISKEE~1C:\Program Files\DMV\MaxTV4\plugins;
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
"PROCESSOR_REVISION"=0f0d
"NUMBER_OF_PROCESSORS"=2

-----------------EOF-----------------