Virus mal autorun

Salut Nirvana666Cherry

Un que j'ai oublié, ton lecteur H:, a été analysé et une infection pas pris en charge par l'outil, refais ceci :

(!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, caméra, Carte SD, etc...) susceptible d avoir été infectés sans les ouvrir

• Double clic sur le raccourci UsbFix présent sur ton bureau

• Au menu principal choisis l'option " F " pour français et tape sur [entrée] .

• Au second menu Choisis l'option " 2 " ( Suppression ) et tape sur [entrée]

• Ton bureau disparaîtra et le pc redémarrera.

• Au redémarrage, UsbFix scannera ton PC, laisse travailler l'outil.

• Ensuite poste le rapport UsbFix.txt qui apparaîtra avec le bureau.

• Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque.( C:\UsbFix.txt )

( CTRL+A Pour tout sélectionner , CTRL+C pour copier et CTRL+V pour coller )

@++ :)

Salut dédétraqué,

Voici le rapport du scan :

Logfile of random's system information tool 1.06 (written by random/random)
Run by Fire and Ice at 2010-03-17 08:15:34
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 28 GB (23%) free of 118 GB
Total RAM: 2559 MB (78% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:15:40, on 17/03/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Linksys\WUSB54GC\WifiSvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Fire and Ice\Bureau\Antivirus\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\trend micro\Fire and Ice.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Browser Defender BHO - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: PC Tools Browser Guard - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Program Files\Spyware Doctor\BDT\PCTBrowserDefender.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SPC610NC_Monitor] C:\WINDOWS\Philips\SPC610NC\Monitor.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AutorunRemover.exe] C:\Program Files\AutorunRemover\AutorunRemover.exe -Hide
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Lanceur.lnk = C:\Program Files\Micro Application\LauncherMA.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Launch WhiteSmoke.lnk = C:\Program Files\WhiteSmoke\WSEnrichment.exe
O4 - Global Startup: Wireless Network Monitor.lnk = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Browser Defender Update Service - Threat Expert Ltd. - C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)
O23 - Service: WUSB54GC - Unknown owner - C:\Program Files\Linksys\WUSB54GC\WifiSvc.exe

Salut Nirvana666Cherry

Refais un scan avec RSIT et poste le contenu du rapport log.txt à la fin de l’analyse

Le rapport est dans le dossier ici C:\rsit

@++ :)

Salut dédétraqué,

Il n'est pas dans ma barre des taches en bas à droite, juste sur mon bureau et quand je clique droit dessus je n'est pas de "activer Avira" ou quelque chose de ce genre. Et lorsque je vais dans panneau de config pour le désinstaller il me met un message d'erreur : "Echec de l'initialisation des modules de produit.
Dois-je quand même faire le registre ou pas ?

Salut Nirvana666Cherry

C'est mal expliqué sur leur site, faire un clic droit sur l'icône d'AntiVir dans la barre des tâches (en bas à droite), clique sur "Activer Antivir Guard" afin de le désactiver puis désinstalle le programme à partir de l'outil Ajout/suppression de programmes qui se trouve dans le Panneau de configuration.

Passe l'outil pour le registre de nouveau et faire le scan en ligne

@++ :)

Salut dédétraqué,

Le premier lien que tu m'as donné n'a pas désinstaller Avira. Il a juste fait un scan. Je fais quand même le registre ?

Salut Nirvana666Cherry

Désinstalle Antivir avec cet outil:
http://dlpro.antivir.com/package/removaltool/win32/en/removaltool-win32-en.exe

Passe cet outil pour le registre :
http://dlpro.antivir.com/down/windows/registrycleaner_en.zip

Fais de nouveau un scan en ligne ici :
https://www.eset.com/int/home/online-scanner/

@++ :)

Salut dédétraqué,

Voila j'ai réussi à le mettre.
Voici le lien : http://ww38.toofiles.com/fr/oip/documents/pdf/drweb.html

Salut Nirvana666Cherry

Voir avec :
http://ww38.toofiles.com/fr/

Clique sur Document dans le haut

@++ :)

Je fait quoi après avoir mis le lien sur le site ?

Non attend j'ai rien dit...
J'ai réussi à le mettre sur le premier site que tu m'as donner. Désolé. ^^

Salut Nirvana666Cherry

Combien fais le fichier??

@++ :)

Le fichier est trop lourd je crois pour le site.

Salut Nirvana666Cherry

Envoie ici :
https://www.filedropper.com/
http://ww38.toofiles.com/fr/

@++ :)

Salut dédétraqué,

Je crois que le dossier est trop lourd. Où je peux te l'envoyer ?
Et je voulais encore te remercier de ta patience et de toute l'aide que tu m'apportes.

Salut Nirvana666Cherry

Télécharge Dr.Web CureIt! sur le Bureau :
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

- Double clique sur l'icône de drweb-cureit.exe sur le bureau et clique sur Commencer le scan.
- Si des infections sont trouvées après ce scan rapide, clique sur le bouton Oui pour Tout.
- Après ce scan rapide, sélectionnez Analyse complète et clique sur la flèche verte à droite.
- Le scan du PC va débuter, le scan peut-être très très long.
- Si une infection sont trouvée, clique sur le bouton Oui pour Tout.
- A la fin du scan, si des infections sont trouvées, clique sur Tout sélectionner, puis sur Désinfecter. Si la désinfection est impossible, clique sur Quarantaine.
- Au menu principal de l'outil, en haut à gauche, clique sur le menu Fichier et choisissez Enregistrer le rapport.
- Sauvegarde le rapport sur votre Bureau. Ce dernier se nommera DrWeb.csv.
- Ferme Dr.Web CureIt!
- Redémarre ton PC (très important) car certains fichiers peuvent être déplacés/réparés au redémarrage.
- Suite au redémarrage, poste (Copie/Colle) le contenu du rapport de l'outil Dr.Web dans ta prochaine réponse.

@++ :)

Salut dédétraqué,

J'ai fais le scan d'après ce que j'ai vu j'ai des virus assez important, voici le rapport :

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=92bce6d930fd6c4d84b303117d33bac9
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2010-03-12 09:44:10
# local_time=2010-03-12 10:44:10 (+0100, Paris, Madrid)
# country="France"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 94685 94685 0 0
# compatibility_mode=1797 16774122 100 96 355292 64479571 0 0
# compatibility_mode=8192 67108863 100 0 3942 3942 0 0
# scanned=67074
# found=18
# cleaned=10
# scan_time=10990
C:\Documents and Settings\Fire and Ice\Mes documents\eMule Downloads\Incoming\(2009) Guitar Pro 5 .zip Win32/Agent.QKL trojan (deleted - quarantined) 00000000000000000000000000000000 C
C:\Program Files\Avira\AntiVir Desktop\avadmin.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\avupgsvc.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\avwsc.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\fact.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\licmgr.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\setup.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\update.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\Program Files\Avira\AntiVir Desktop\wsctool.exe Win32/Sality.NAR virus (error while cleaning) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{8EC412C0-29B2-4AC4-83C4-7AC58EA4CBEA}\RP112\A0065424.exe Win32/Boberog.AK worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{8EC412C0-29B2-4AC4-83C4-7AC58EA4CBEA}\RP114\A0068840.rbf Win32/Sality.NAR virus (cleaned - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{8EC412C0-29B2-4AC4-83C4-7AC58EA4CBEA}\RP114\A0068841.exe Win32/Sality.NAR virus (cleaned - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{8EC412C0-29B2-4AC4-83C4-7AC58EA4CBEA}\RP114\A0068842.exe Win32/Sality.NAR virus (cleaned - quarantined) 00000000000000000000000000000000 C
C:\System Volume Information\_restore{8EC412C0-29B2-4AC4-83C4-7AC58EA4CBEA}\RP114\A0068843.exe Win32/Sality.NAR virus (cleaned - quarantined) 00000000000000000000000000000000 C
C:\UsbFix\Quarantine\C\WINDOWS\msnmgr.exe.UsbFix Win32/Boberog.AK worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\UsbFix\Quarantine\H\autorun.inf.UsbFix INF/Autorun.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\UsbFix\Quarantine\J\autorun.inf.UsbFix INF/Autorun.gen trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\_OTM\MovedFiles\03112010_181410\C_Documents and Settings\Diiamant\Mes documents\PIC08251779-JPG-www-facebook-com.scr Win32/Boberog.AK worm (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

Salut Nirvana666Cherry

On va vérifier si rien de caché :

Faire un scan avec Nod32 en ligne (il faut utiliser Internet Explorer) ici :

https://www.eset.com/int/home/online-scanner/

(coche toutes les cases à chaque fois, sauf les deux dernières a la fin du scan, sinon le rapport est supprimer)
A la fin, colle le rapport : C:\Program Files\EsetOnlineScanner\log.txt

@++ :)

Et voila le rapport de RSIT :

Logfile of random's system information tool 1.06 (written by random/random)
Run by Fire and Ice at 2010-03-11 18:22:56
Microsoft Windows XP Édition familiale Service Pack 3
System drive C: has 28 GB (24%) free of 118 GB
Total RAM: 2559 MB (83% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:23:00, on 11/03/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Linksys\WUSB54GC\WifiSvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Fire and Ice\Bureau\RSIT.exe
C:\Program Files\trend micro\Fire and Ice.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SPC610NC_Monitor] C:\WINDOWS\Philips\SPC610NC\Monitor.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AutorunRemover.exe] C:\Program Files\AutorunRemover\AutorunRemover.exe -Hide
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Lanceur.lnk = C:\Program Files\Micro Application\LauncherMA.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Launch WhiteSmoke.lnk = C:\Program Files\WhiteSmoke\WSEnrichment.exe
O4 - Global Startup: Wireless Network Monitor.lnk = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O23 - Service: Avira AntiVir Planificateur (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)
O23 - Service: WUSB54GC - Unknown owner - C:\Program Files\Linksys\WUSB54GC\WifiSvc.exe

Coucou dédétraqué, sa vas tu ne perd pas espoir avec mon PC. ^^

Voici le rapport OTMoveIt :

All processes killed
========== SERVICES/DRIVERS ==========
Service asc3360pr stopped successfully!
Service asc3360pr deleted successfully!
Service catchme stopped successfully!
Service catchme deleted successfully!
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\Documents and Settings\Diiamant\Mes documents\PIC08251779-JPG-www-facebook-com.scr deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winippinj.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w948c5.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winnhhct.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w1af974.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvsbh.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w970af.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\menubc.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpugbl.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w9304b.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winawkvia.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jckvi.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\w1e0cbf.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\nfeqgx.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jnwsxo.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\kbtmh.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wab0b1.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winxcwee.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winarpvla.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\we9585.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winldofy.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winkwsy.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\hwfh.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\rmhr.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\lcxqwn.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winnhmvu.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winrdfbo.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\geexy.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\uwyv.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\Diiamant\LOCALS~1\Temp\winggxbb.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wwpto.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wa2d58.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winoyidc.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\bkjs.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\ydvfjc.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpwgjfh.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvhvq.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\imqja.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winytkama.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winwpbdxn.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\wincjqfx.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\bcde.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winvlcpnw.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\vfyq.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\lbsvt.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\shrsu.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\lsrars.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\ohts.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winqqgmqb.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winpgqnbd.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\itwgn.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\jchw.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winyyqusq.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\\C:\DOCUME~1\FIREAN~1\LOCALS~1\Temp\winuhgtmh.exe deleted successfully.
========== FILES ==========
LoadLibrary failed for C:\Documents and Settings\Fire and Ice\LOCAL Settings\Temp\KERNEL.DLL
C:\Documents and Settings\Fire and Ice\LOCAL Settings\Temp\KERNEL.DLL moved successfully.
C:\Documents and Settings\Diiamant\Mes documents\PIC08251779-JPG-www-facebook-com.scr moved successfully.
C:\WINDOWS\system32\OLDFF.tmp moved successfully.
C:\WINDOWS\system32\OLDFB.tmp moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: Diiamant
->Temp folder emptied: 646575 bytes
->Temporary Internet Files folder emptied: 1208278 bytes
->Java cache emptied: 12118723 bytes
->FireFox cache emptied: 88195496 bytes
->Flash cache emptied: 6448 bytes

User: Fire and Ice
->Temp folder emptied: 68279707 bytes
->Temporary Internet Files folder emptied: 18309409 bytes
->Java cache emptied: 28577971 bytes
->FireFox cache emptied: 77866294 bytes
->Flash cache emptied: 8313 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 3072 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 5216949 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 287,00 mb

OTM by OldTimer - Version 3.1.10.0 log created on 03112010_181410

Files moved on Reboot...

Registry entries deleted on Reboot...